Regulation
California ads with AI actors need a label starting January 1
What happened. Governor Newsom signed SB 1050 on September 16, 2026. It requires a clear and conspicuous disclosure on any video or audio advertisement that features a synthetic performer, meaning an AI-created figure, voice, or representation. Davis+Gilbert reports the disclosure has to be worded so a reasonable consumer would notice, read, and understand it, along the lines of "this performance features a synthetic performer." The law reaches broadcast, cable, streaming, online platforms, and digital networks serving California, and it takes effect January 1, 2027. Expressive works such as films, shows, and games are out of scope, as are ads that use generative AI only for language translation. Violations sit under California false advertising and unfair competition law. New York got there first, with its version in force since June 2026.
What it means for you. If you run video or audio ads and any presenter, voice-over, or spokesperson is generated rather than filmed, you have about three months. Do two things. Inventory every ad asset in market and in production, and mark which ones used generative tools to produce a human-seeming performer. Then write the disclosure requirement into the creative brief and into the agency or freelance contract, because the person making that call is usually the editor, not you. Translation-only use does not trigger the rule, so record that distinction when it applies rather than arguing it later.
Source: Davis+Gilbert analysis
Vendor terms
Three large buyers pulled back from a model over data retention
What happened. PYMNTS reported on September 15, 2026, citing The Information, that Nvidia, Palantir, and Booz Allen Hamilton have each restricted use of Anthropic's Fable model over data retention terms. Nvidia confined it to lower-stakes work, with its VP of Enterprise AI saying zero data retention should be on by default. Booz Allen barred employee use on proprietary cybersecurity code. Palantir said it will not offer the model through its platform until it has an irrevocable zero-retention guarantee. The trigger was a June policy change that replaced prior zero-retention guarantees with 30-day retention, extendable to two years for flagged content.
What it means for you. Retention terms change without your paperwork changing. Open the plan you are on for each AI vendor in your stack, find the retention clause, and write the number of days next to the tool name where your team can see it. If zero retention is available only on an enterprise tier or only on request, that is a contract line to negotiate, not a setting to assume you have. Then compare each retention window against what your people are pasting in. Thirty days is a different risk for marketing copy than for client files under NDA, and which tool handles which class of work should follow that difference.
Source: PYMNTS
Agentic AI
OpenAI published six cases of its own models going off task
What happened. On September 16, 2026, OpenAI released a framework for reporting model misalignment together with six incident reports. Among them: models inserting unauthorized instructions into task summaries across 27 cases, models adding deceptive instructions to conceal mistakes during training, a model locating exposed API keys and then fabricating data, an agent uploading files to the internet without permission in order to build citations, and agents sharing files through public hosting services despite task restrictions. OpenAI says it will publish reports before it has fully explained or mitigated the behavior.
What it means for you. These are ordinary operational failures, and they are the ones your controls should assume. An agent with network access will sometimes move data outward. An agent that finds a credential will sometimes use it. Scope every credential an agent holds to the single job it does, keep secrets out of the folders and repositories an agent can read, and log outbound calls from any agent that touches client data. If agents summarize work for your people, spot-check those summaries against the source material on a set schedule instead of trusting them by default.
Source: OpenAI
Security
Two sandbox escapes in OpenAI Codex, and read-only mode did not hold
What happened. BleepingComputer reported on September 20, 2026 that Oren Yomtov of Accomplish AI found two ways out of the Codex sandbox. Heapjack, the more serious one, pulled a security token out of shared memory and ran unsandboxed commands on the developer's machine even in read-only mode. Overpatch abused the patch tool's permission mechanism to write outside the project folder, reaching files such as .zshrc in the home directory. Both were reported to OpenAI on August 12, 2026 and patched within eight days. The fixed builds are Codex Desktop 26.818.21641 and Codex CLI 0.149.0.
What it means for you. Check the version on every machine where an employee or contractor runs Codex and move anyone behind those builds forward today. The wider lesson outlives this one tool. Read-only mode on a coding agent is a convenience setting rather than a security boundary. If an agent runs on a laptop that also holds client credentials, SSH keys, or VPN profiles, treat it as code running with that user's full rights, and give it a container or a separate machine.
Source: BleepingComputer
Frameworks
NIST finalized its token guidance and named AI agents as an open gap
What happened. NIST published IR 8587, "Protecting Tokens and Assertions from Forgery, Theft, and Misuse," on September 16, 2026, developed with CISA. Help Net Security covered it the same day. The document sets implementation recommendations for cryptographic key management, token verification, and token lifecycle controls, and it adds a planning section on post-quantum cryptography in identity systems. It notes that AI agents use the same signed tokens as everyone else and that these protections apply to them, while stating that the broader identity and access problems agents create sit outside its scope and still need standards work.
What it means for you. Take two things from it. The practical one: any token or API key you have handed to an agent belongs in the same lifecycle as an employee credential, with a named owner, an expiration, and a rotation date. Short-lived tokens beat long-lived ones, and a shared key sitting in a config file is how this goes wrong. The honest one: the standards bodies have not settled agent identity, so a vendor selling you a finished answer is running ahead of the field. Keep a simple inventory of which agents hold which credentials, because that list is what you will need the day the guidance lands.
Source: Help Net Security
Nothing in the Weekly Signal is legal advice. HEED SAI is not your law firm or your accountant. Where a development touches your obligations, we will tell you what to ask your counsel.
