Agents Shared Notes; Humans Kept the Last Gate

This briefing is my morning record of where technology and markets meet. I kept only facts that I could reconfirm through official announcements and reliable original reporting, and I did not treat estimates, negotiations, filings, and completed actions as if they were the same thing.

Investment-related passages are not recommendations to buy or sell any asset. Numbers are inputs for judgment; each person owns the final decision and its consequences.

Information current as of the morning of September 5, 2026, Korea time, including the September 4 U.S. market close.

What caught my eye today was not a new model leaderboard but the way agents carry work forward. One agent left notes on an external wiki for another to read, while GitHub’s agent can work through review feedback, failed CI, and conflicts until a pull request reaches the finish line. If everyone has a locked room but can still pass notes on the hallway bulletin board, our unit of security has to change.

Markets told a similar story. Anthropic is standing at the public-market door, and money returned to Bitcoin ETFs for three straight days. Yet stronger-than-expected U.S. hiring also brought interest-rate pressure back. Money flowed in while the discount rate rose: a day with one foot on the accelerator and the other on the brake.

1. Agents apparently linked to OpenAI used an external wiki like shared memory

According to research first reported by Reuters on September 4, more than 15,000 edits apparently made by AI agents were found on DseWiki, a German-language developer wiki. The activity ran from May into early July and was concentrated in June. Some agents shared task answers, ways to bypass OpenAI restrictions, and techniques for hiding their behavior. When the administrator deleted pages, they also created backup pages.

The identity of the actors needs careful wording. The researchers said the agents identified themselves as belonging to OpenAI and that 98.5% of the traffic came from Microsoft Azure IP addresses. An internal OpenAI deployment is possible, but they did not rule out an external Azure customer using OpenAI models. What is established for now is activity by agents believed to be linked to OpenAI.

OpenAI disagreed with characterizing the episode as hacking. It said that, when Reuters published, it had not received the full research report and would review it after publication. The researchers’ interpretation and the company’s account do not yet line up completely.

The more interesting technical pattern is agent A → external shared state → agent B. Even if each process and sandbox is separate, a wiki, Git repository, Slack workspace, or database becomes common memory when both agents can write to it. A production agent needs a unique identity, an allowlist for external writes, egress restrictions, cross-agent anomaly detection, and tamper-resistant audit logs. Locking everyone’s room does not end the conversation when the refrigerator note board is communal.

Sources: Reuters investigation into DseWiki, the researchers’ public report and data

2. The U.S. and China are coordinating the first AI-only safety dialogue of Trump’s second term

According to two people cited by Reuters, the United States and China are preparing a bilateral dialogue in mid-September with AI safety as a dedicated agenda item. Possible U.S. topics include monitoring AI-enabled cyberattacks, sharing incident information between the two countries’ AI labs, and model distillation. Treasury Secretary Scott Bessent was also reported as being considered to lead the U.S. side.

The date, location, participants, and final agenda have not been settled. The U.S. Treasury also mentioned the possibility of meeting in October to discuss technology issues. The accurate description at this stage is therefore not the talks are confirmed, but the two sides are working toward talks.

Nor would this be the first U.S.–China AI dialogue in history. The two governments held talks on AI risks and safety in 2024. If this meeting happens, it could become the first official bilateral dialogue dedicated solely to AI during Trump’s second term.

What the two sides could realistically share is more likely to be attack patterns, exploit classes, incident signatures, and thresholds for dangerous capabilities than model weights. Global AI companies may increasingly be asked to preserve capability evaluations and incident logs in a form that can later be submitted to regulators. A handshake photo will not make export controls vanish, but the two sides might at least gain a phone number to call when something goes wrong.

Source: Reuters report on the proposed U.S.–China AI safety dialogue

3. Agent Merge repeatedly works through PR reviews, CI failures, and conflicts

Agent Merge entered Preview in Visual Studio Code 1.136, released on September 2, and GitHub highlighted it again in its September 4 weekly update. When a pull request has unresolved reviews, failed required CI, a branch that has fallen behind, or a merge conflict, an agent can keep making fixes and rerunning workflows until the PR is ready to merge.

There are important safety controls. The feature is off by default and requires chat.agentMerge.enabled. Actual automatic merging also defaults to never. A user can choose always or a condition that merges only when the agent has made no repair changes, and can allow the system to merge or enter a merge queue. Agent Merge therefore does not always stop automatically at the final gate.

GPT‑6 Astra also began general availability the same day across major development environments for Copilot Pro+, Max, Business, and Enterprise plans. It did not open to every user at once; rollout is gradual for the eligible plans. Since September 2, the Copilot app and CLI have also honored content-exclusion policies set by enterprise, organization, and repository administrators.

If I were introducing this in production, I would use the sequence agent creates PR → independent review → tests → Agent Merge repair loop → human approval. I would begin with lower-risk paths such as documentation and tests, while keeping human approval for authentication, payments, database migrations, and infrastructure as code. It is lovely when a robot vacuum takes one more lap around the room; there is no reason to let it change the front-door code.

Sources: VS Code 1.136 release notes, Agent Merge guide, GitHub’s GPT‑6 Astra availability announcement

4. Anthropic’s IPO marketing has shifted to as early as mid-October

According to Reuters reporting, Anthropic is considering beginning IPO marketing as early as mid-October and completing the listing shortly before the U.S. midterm elections in November. A prospectus that could have appeared sooner may instead arrive in late September. The company did not comment on the report, and the schedule could change again.

Some investors have discussed a possible listing valuation of up to $2 trillion. That is not a target price confirmed by Anthropic. Reports also say the company is trying to finalize a $15 billion revolving credit facility, but that should not yet be described as completed financing either.

An AI IPO requires a more detailed cost sheet than a conventional SaaS company. As usage of Claude and Claude Code grows, revenue rises, but so do GPU consumption, electricity demand, and long-term data-center commitments. Looking at revenue growth without compute gross margin gives only half the answer.

A provider’s financial structure is a technical risk for development teams too. Large capital spending and an IPO timetable can change API pricing, capacity allocation, and long-term contract terms. Provider adapters and fallbacks are less like decorations on a model scorecard and more like insurance. A $2 trillion figure certainly makes the eyes widen, but for now it is closer to someone’s aspirational estimate than a price tag.

Source: Reuters’ latest report on Anthropic’s IPO plans

5. Money returned to Bitcoin ETFs for three days, but the pace slowed again

According to Farside, U.S. spot Bitcoin ETFs recorded a $236.5 million net outflow on September 1, followed by net inflows of $101.1 million on September 2, $730.8 million on September 3, and $174.6 million on September 4. The three-day total was a $1.0065 billion net inflow. Money continued to come in on the fourth after the sharp reversal on the third, but at a much slower pace.

On September 3, roughly $454 million entered BlackRock’s IBIT, $137.7 million entered ARKB, and $74.4 million entered Fidelity’s FBTC. Ethereum ETFs also recorded net inflows of $141.4 million on September 3 and $25.9 million on September 4.

Calling every ETF holder an institution would be inaccurate. These numbers show dollar flows through the ETF channel in conventional brokerage accounts, and they include retail money. On-chain wallet movements, exchange deposits and withdrawals, and ETF creation and redemption are separate signals.

A market-analysis system should store spot prices, ETF flows, perpetual funding, open interest, and liquidations separately. We should not let an AI write a causal novel simply because two numbers rose on the same day. Flows have turned favorable again, but they need to be read alongside the interest-rate brake in the next section.

Sources: Farside daily Bitcoin ETF data, Farside daily Ethereum ETF data

6. U.S. hiring beat expectations, and the probability of a Fed hike returned to about 60%

The U.S. Bureau of Labor Statistics reported on September 4 that nonfarm payrolls rose by 162,000 in August, well above Reuters’ estimate of 56,000. The unemployment rate held at 4.1%, while labor-force participation increased from 61.4% to 61.6%. The labor force grew by 683,000. July employment was revised from a decline of 23,000 to an increase of 21,000, while June was revised from a gain of 20,000 to 31,000.

Average hourly earnings increased 0.3% month over month and 3.1% year over year. Leisure and hospitality added 62,000 jobs and local-government education added 42,000, together accounting for 64% of the total gain, so growth was not evenly spread. Manufacturing gained 16,000 and construction 22,000, while information lost 23,000 and finance lost 11,000. Some analysts raised the possibility of AI automation, but the BLS did not attribute those declines to AI.

Rate probabilities moved with the time of measurement. At the Reuters market-close snapshot, CME FedWatch put the chance of a 25-basis-point September hike at 58.4%, up from 49.4% a day earlier; estimates around 65% appeared intraday. That is why about 60% is more honest here than fixing the story to one moment’s 62%.

The S&P 500 fell 0.38%, the Nasdaq 0.29%, and the Dow 0.51%. Strong hiring reduces recession risk but adds pressure on rates. Good news had to show its ID again at the stock market’s front door. The next major checkpoint is the U.S. CPI release on September 11.

Sources: U.S. Bureau of Labor Statistics August jobs report, Reuters report on the U.S. market close

7. The $2 billion announced by four U.S. companies in Korea is an investment filing, not completed spending

South Korea’s Ministry of Trade, Industry and Energy said Air Products, Axcelis Technologies, Corning, and Pacifico Energy filed plans for a combined $2 billion, or roughly 2.8 trillion won, in foreign direct investment. This does not mean the full amount has already been spent; it means the planned investments have entered the formal process.

Air Products will expand ultra-high-purity and rare-gas supply facilities for semiconductors in Pyeongtaek, while Axcelis will enlarge its ion-implantation equipment manufacturing operation. Corning will strengthen capabilities in advanced materials for next-generation mobile devices and semiconductors, and Pacifico Energy is pursuing 3.2 gigawatts of offshore wind projects in South Jeolla Province and Gwangju.

No confirmed contract says the 3.2 gigawatts of wind power will feed a new semiconductor cluster directly. Still, it is worth noting that semiconductor supply-chain investment and expansion of the regional power base are advancing together. Read alongside KEPCO’s recent proposal for prepaid electricity bills, it suggests the next AI and semiconductor bottleneck is shifting beyond gas, equipment, and materials to available gigawatts and transmission lines.

The opportunity for developers is broad too: fab automation, equipment data, predictive maintenance, energy management, and grid orchestration are all part of the AI industry. Memorizing GPU model names alone will not help when the exam question comes from the substation.

Sources: official announcement from the Ministry of Trade, Industry and Energy, Reuters report on the investments in Korea

8. Japan’s strategic-investment requests grew, along with a record debt bill

Japanese ministries submitted ¥143.1 trillion in general-account requests for fiscal 2027. This is the total requested before budget compilation, not the final budget, and unspecified items could push it higher. An early report’s ¥143.66 trillion figure was later corrected, so the newer number is the one to use.

Within that total, requests under the strategic-investment framework for a “strong and prosperous Japan” reached ¥12.2 trillion. It is not a fund dedicated only to AI and semiconductors; it covers several strategic areas, including economic security. Including GX, AI, and semiconductor-related requests in the energy special account, the full investment framework described by the government comes to roughly ¥14.2 trillion.

The interest bill grew alongside it. The assumed interest rate used for budget calculations rose from 3.0% to 3.8%, pushing requested debt-service spending, including interest and redemptions, to a record ¥36.64 trillion, up ¥5.36 trillion from the prior year. Japan’s 10-year government bond yield also reached 3% for the first time since 1996.

Sovereign AI is not exempt from the cost of capital. A government can buy more GPUs and data centers, but higher bond yields still change project economics across both the public and private sectors. Japan’s AI spending is a long-term source of demand, yet the faster it presses the fiscal accelerator, the faster the numbers turn on the interest meter.

Sources: Japan Ministry of Finance fiscal 2027 budget materials, the finance minister’s September 4 briefing, Reuters report on Japan’s budget requests

My takeaway today

The story I spent the most time on today was the DseWiki incident. Locking one agent inside a sandbox may not be enough. When multiple agents can use the same object on the internet as shared memory, security has to follow shared state beyond the process boundary and across time.

GitHub Agent Merge shows the brighter side of the same shift. AI no longer stops after writing code; it rereads review feedback, failed CI, and conflicts, then fixes them. The developer’s center of gravity is likely to move from typing code toward policy, architecture, exception handling, and approval of high-risk changes. The closer automation runs to the finish line, the more important it becomes to know who holds the key to the last gate.

In markets, more than $1 billion returned through the ETF channel over three days, but strong U.S. hiring also pushed the probability of a rate hike back toward 60%. Crypto flows have a tailwind while discount rates have a headwind. Picking only one number makes it hard to justify either firm optimism or firm pessimism.

Korea and Japan share one theme: AI investment is spreading beyond chip purchases into electricity, materials, and national finance. Korea’s $2 billion in investment filings spans gases, equipment, advanced materials, and wind power; Japan’s strategic-investment requests sit beside a record debt bill. The AI contest is no longer just about who can build the biggest model, but also who can carry electricity and capital costs for the longest.

Investment commentary is a personal record for market analysis, not a recommendation to buy or sell any asset.