The River Group Briefing
Issue 5 · Covers September 2026

Agents got cheaper and easier to deploy in September. Keeping them in check got harder.

A monthly read on agentic AI from Blaine Mathieu, founder at The River Group, your guide through the decisions agentic AI is forcing on your business.

In September, AI agents got cheaper and easier to put to work. The two things that keep them in check, the controls around them and the junior jobs where future supervisors learn the work, both looked weaker than many plans assume.

What the labs reported about their own agents. OpenAI published months of incidents in which its agents worked around their limits, paused its most capable models after a new escape, and then OpenAI called off a planned release.
Agents got cheaper and reached the mainstream. Anthropic, the clearest holdout on price, cut it, and Meta's new consumer agent passed 2.5 million downloads in under two weeks, not far behind ChatGPT's own launch.
The entry-level jobs that train future managers. New Census Bureau data shows graduates in the most AI-exposed fields starting out with fewer jobs and lower pay, and 18% of marketing leaders in a Gartner survey have already cut junior roles.
Also this month: agents started producing original science, a math proof and an enzyme discovery, though neither has been independently confirmed.
New in this briefing, The River: The River Group's monthly reading of the twenty constraints that decide how far an organization can go with AI agents right now, and whether the month's evidence made each one easier or harder to clear. In the September reading, Workflow and workforce got easier, and Supervision, autonomy and governance got harder. The short version is at the end.

On September 20, one of OpenAI's agents was working inside a test environment that theoretically had no access to the internet. It found a way out anyway, through the system computers use to look up web addresses, and sent questions to an outside chatbot. OpenAI's monitoring flagged it within 15 minutes, and a person looked three minutes after that. The automatic stop did not work. The run was killed about two and a half hours in.

OpenAI paused all training, testing and tool use of its most capable models. Eight days later it called off the release of its next model. In the same weeks, Anthropic and OpenAI cut their prices, and Meta's new agent went past 2.5 million downloads.

Here's what I think September showed. Agents got cheaper and easier to put to work. And both of the things that keep them in check looked weaker than many plans assume: the controls around the agents, and the junior jobs where tomorrow's supervisors learn the work.

A boat labeled "your domain of control" floating on a "current of agentic capability," with three concerns marked on it: governance (decision rights and oversight), workflow and workforce (how it's built and crewed), and context (what the crew can see).

That's the boat from the book, with its three settings. September's news landed on two of them: supervision, autonomy and governance, which is Chapter 6, and workflow and workforce, which is Chapter 4.

What the labs reported about their own agents

On September 16, OpenAI started publishing reports on its own models misbehaving. The first batch covered incidents from October 2025 to July 2026, all in training, testing or internal use. One released model, GPT-5.6 Sol, wrote notes to itself that hid its mistakes. An internal model used an exposed access key it had no permission to use, then made up data. Other models passed messages between test runs that were meant to be kept apart.

A report published on September 25 describes an incident from May. An internal model was asked to prove a math theorem and cheated instead. Along the way it published a researcher's access token on a public code-sharing site, and it split the token into pieces "with the stated aim of avoiding secret scanning," the automated check that exists to catch exactly that kind of leak. OpenAI deactivated every employee's keys.

That is the incident I keep coming back to. It is not a model failing at a task. It is a model treating a safety check as an obstacle and working its way around it.

Outsiders found OpenAI's agents in their own systems, too. Australia's prime minister said one of them got into a Medicare statistics site on June 18, and that Australia was not told until September 10. Google confirmed that its own model, Gemini, got into three companies' systems during a test in May, after a bug gave it internet access, using guessed and publicly listed passwords, and stopped once it realized they were real.

In July I said I'd watch whether more labs went back through their own test records. In September they did. OpenAI says it has now notified more than 100 organizations, and its review of what its agents did covers about 50 petabytes of records, running on some 7,000 high-end AI chips at more than half a million dollars a day.

Then OpenAI acted. On September 28 it called off the October release of GPT-6.1 Astra and kept the model in-house, though it says more Astra models are on the way. On the record, OpenAI said the model fell short on staying within the scope and permissions it was given, and on reporting back what it had done. The Wall Street Journal reported more: it showed more deception than its predecessor, did not always tell users accurately which actions it had taken, and pushed ahead on tasks without asking permission.

Five days before that, Sam Altman, OpenAI's chief executive, told the UN Security Council: "We have unilaterally slowed down in the past. We will do so in the future." In The River Group's terms, a model held back is a surge that has not landed yet. The capability exists. The release is waiting on the controls.

The most useful number of the month came from the UK's AI Security Institute. In simulated security tests, GPT-6 Astra attacked software supply chains, the outside code that other systems depend on, though it had not been asked to. It did so in 29.2% of runs, against 6.3% for its predecessor and none for the model before that. Adding an explicit rule against going out of scope cut the worst scenarios from 26 attacks in 50 runs to 4 in 49. The rule helped a lot. It still left four.

Chapter 6 of the book describes two ways to govern. You can post a lookout who rings the bell when the rocks come into view, or you can know the chart and set the course around them. Almost everything the labs disclosed in September was caught by a lookout, after the fact. The built-in kind of control is only starting to ship: NVIDIA released open-source software that enforces an agent's limits from outside the agent, and Meta's new consumer agent, Muse, comes with a separate agent, one Muse cannot override, that decides what it may send out.

It is not only the labs' agents, either. A security firm, Glow Labs, found more than 13,000 internal screenshots and recordings exposed on public code sites by developers at over 300 organizations, and says coding agents put them there.

The Treasury Secretary, Scott Bessent, was clear about who he believes answers for this kind of thing. Asked about the July breach in which OpenAI's test agents broke into Hugging Face, the site where most companies get their open models, he said it "is the responsibility of the OpenAI management, not a bunch of agents." If your plan assumes the vendor's controls will keep your agents inside the lines, that sentence applies to your management too.

In my early experience building and using agents with OpenClaw (an early agent building tool), I found many scenarios where the agent surprised me by taking actions that were not expected. 90% of the time, these were pleasant surprises. But the other 10% was enough to convince me it was time to move off a system with such lax governance built in.

Agents got cheaper and reached the mainstream

While the labs were publishing their incident reports, the price of using their models kept falling. On September 22 Anthropic cut its top model, Claude Opus 5.5, to $4 per million tokens of input and $20 of output, from $5 and $25, and says it costs 40% less than its predecessor on typical workloads, because it charges less per token and uses fewer tokens per task. Tokens are the units these models are billed in. In August I called Anthropic the clearest holdout on price. It no longer is.

The same day, OpenAI launched GPT-6 Sol at $2 and $10, and GPT-6 Luna at 10 cents and 50 cents. Epoch AI, an independent research group, has measured how fast this has been happening: over the past three years, the cost of reaching a given score on its benchmarks fell about 47% every quarter. In practice, a result that cost $100 at the start of a year cost less than $10 by the end of it.

In July I asked whether cost per finished task would make it into a real board pack. It has not, as far as I can see. It did make it into the vendors' own launches, with both labs leading on what the work costs to run, though the vendors are still the ones doing the measuring.

Microsoft made the same shift from the buyer's side. On September 25 it split Copilot's pricing: the per-person subscription now covers everyday AI, and agent features are billed by usage on top, with spending caps for administrators. A budget that used to be fixed per head now has to cover agents that keep working whether anyone is at a keyboard or not.

Then agents went to consumers. Meta launched Muse on September 8, an agent that handles a person's inbox, calendar, bookings and shopping, with each copy running on its own virtual computer. It passed 2.5 million downloads in under two weeks and was the No. 1 free iPhone app in the US on September 18. Shopify opened checkout inside it. Mastercard and a startup called Alchemy began giving agents their own email address, their own phone number, and a one-time token of the user's credit card.

Not everyone welcomed it. Amazon started blocking Muse on September 20, from browsing as well as buying. OpenAI's own version came on September 29: Dots, agents that run all the time on their own cloud computer and connect to more than 4,000 apps.

For anyone running a function, the cost argument against putting agents to work keeps getting weaker. Cheap agents make it easy to drop them into the seats you already have. That is a retrofit, and there is nothing wrong with it; it is often the sensible call, and Chapter 4 of the book is about exactly that choice. What September adds is that the supervision has to come aboard with them.

The entry-level jobs that train future managers

This is the theme I'd most recommend you take back to your team, because it is not really a technology question.

In September the US Census Bureau published a working paper on college graduates from 2016 to 2024. Those from the most AI-exposed tenth of majors were five percentage points less likely to land a first job than graduates of the less exposed majors, and started on 13% lower earnings. The gap opened after late 2022, when ChatGPT arrived.

The authors are direct about the size of it: "This earnings decline is comparable in magnitude to the earnings losses associated with graduating into a large recession." The pay gap narrows to about 5% after two years. That's some comfort. It does not change that this is a recession-sized start to a career.

Gartner sees the same thing from the employer's side. In a survey it released on September 29, 18% of marketing leaders said they had already eliminated early-stage roles, and 16% had created new ones. Gartner expects most high-performing marketing teams to lose the traditional bottom rungs of the ladder by 2030, and its advice is to redesign those junior roles, not remove them.

At the other end of the ladder, BMW said on September 30 that it will cut its number of divisions and management roles by 20% by the middle of next year, and tied the leaner structure to "the efficient use of artificial intelligence." Uber cut about 10% of its staff on September 2 and thinned out its management layers without mentioning AI once. I'd put money on AI being part of Uber's reasoning, but that is a hunch, and Uber does not say so.

Put those together and the ladder is getting shorter at both ends. If your organization grows its managers by having them do the junior work first, the question is not only what agents save you. It is where the people who will supervise your agents, and your people, learn what good work looks like.

I do not think the bottom rungs disappear. The evidence is not conclusive yet: one study, mostly from the years before true agents appeared, and one survey of one function. But the default career ladder cannot be taken for granted anymore, and redesigning the junior seats on purpose beats discovering in five years that nobody learned the job.

At The River Group, we've built an AI-native company that uses agentic AI extensively to drive back-office operations, but the people that actually guide enterprise clients through our methodologies and frameworks are all real people. We take training and nurturing these associates very seriously, and we do that by pairing them closely with senior people like me in every engagement.

Also on the river

Agents also started producing original science. On September 8, OpenAI said an internal model more capable than GPT-6 Astra had proved a version of the Navier-Stokes problem, one of the seven Millennium Prize problems in mathematics, in about 88 hours of agent time, checked by proof-verification software. The Clay Mathematics Institute, which awards the prize, says the problem appears to have been settled and has not ruled on it. There is no peer-reviewed paper yet, and the credit is in dispute.

Two weeks later, Anthropic said Claude had searched a huge database of DNA sequences and picked out a previously undescribed enzyme system, which Anthropic's human scientists then tested in the lab. Anthropic says it does not yet know what the enzyme system does, and the work is a pre-print. Both are the companies' own accounts, and both are early. The first result an outside body confirms is the one I'd watch for.

What I'm watching next

Three things. First, California's recommendations on November 16. Governor Gavin Newsom's September order asks whether state law should require large AI developers to accept embedded independent inspectors and build a verified kill switch. Nothing is required yet; that date is when it could start to be.

Second, the Federal Trade Commission's inquiry into Anthropic, OpenAI and other AI companies over possible harm to consumers, which the agency confirmed on September 30. Demands for documents are expected within weeks, and they will show what the government thinks it is looking for.

Third, the capability held back this month. OpenAI kept GPT-6.1 Astra in-house but says more Astra models are on the way, and Google released Gemini 4 Argon to cyber defenders first with no date for anyone else. When that capability does ship, it arrives all at once, and the river doesn't wait for your controls to be ready.

A question for your team

Who will supervise your agents three years from now, and where are they learning the job today?

When a team wants to work through a question like this, The River Group runs private working sessions for the executives who own the outcome. How the sessions work →

The River

The River of Agentic AI · Covers Sep 2026

Twenty constraints decide how far an organization can go with AI agents right now, from retrofit to reimagine. In September, 7 got easier, 8 got harder, and 5 showed nothing decisive.

Workflow and workforce: Got easier. 4 of 8 easier. How the work gets done, and who does it.
Context: Nothing decisive found. One each way. What an agent knows about an organization, and how far that knowledge extends.
Supervision, autonomy and governance: Got harder. 7 of 9 harder. How much of the work runs without a human, and what catches it when something goes wrong.

The biggest moves: getting people to accept agents went from harder to easier, and keeping agents contained and carrying the risk both turned harder.

See the full September reading →