Nature published DeepSeek-R1 incentivizes reasoning in LLMs through reinforcement learning on 17 September 2025, the peer-reviewed successor to January's preprint, with founder Liang Wenfeng listed as a co-author. The supplementary material discloses for the first time what the reasoning phase cost: about $294,000, run on a 512-chip cluster of Nvidia H800s for roughly 80 hours. The authors also acknowledge, for the first time, that they own A100s, used only to prepare experiments on a smaller model beforehand. R1-Zero was trained with pure reinforcement learning and no supervised fine-tuning, rewarded only on final-answer correctness; the paper reports 77.9% pass@1 on AIME 2024.

The paper went through three rounds of review by eight referees who produced 64 pages of reports and responses before a 17 September publication in Nature 645, 633-638. DeepSeek stated in those referee exchanges that R1 was not trained on outputs from OpenAI models, answering the January accusation directly. Nature's accompanying editorial used the occasion to press the rest of the industry, observing that almost no mainstream large model had been independently reviewed.

GitHub launched the MCP Registry on 16 September as a curated directory of Model Context Protocol servers, each backed by its GitHub repository, with one-click installation inside VS Code and servers surfaced by stars and community activity. Any MCP-compatible host is supported, not just Copilot. Launch partners include Figma's Dev Mode server, HashiCorp's Terraform server and Dynatrace, and the Remote GitHub MCP Server is included. It builds on the MCP project's own registry preview at registry.modelcontextprotocol.io, announced 8 September as an open catalogue and API.

GitHub says it is working with Anthropic and the MCP Steering Committee on an open-source registry that integrates with its own, with self-publication by server authors as the eventual goal. The changelog is explicit that fragmentation is the problem and that a fractured environment fraught with potential security risks is what the registry is meant to close. Twenty-four hours earlier, Kaspersky had shown those risks from the attacker's side.

Kaspersky's Global Emergency Response Team published a proof-of-concept on 15 September in which a rogue MCP server installed on a developer workstation, connected through Cursor, harvested browser passwords, credit card data, cryptocurrency wallet files, API tokens and certificates, and cloud configurations. The victim sees only the legitimate output of the tool. Kaspersky is explicit that it has not observed the vector in the wild, that this was a controlled lab simulation, and that Cursor and Anthropic were notified of the findings.

The attack does not need a CVE. It exploits the trust model around MCP servers: hidden instructions inside tool descriptions that the model reads but the user does not, server names chosen to be nearly identical to legitimate ones, and tool-definition shadowing in multi-server setups that silently redirects later calls. Kaspersky's mitigations are conventional supply-chain hygiene — scan and approve every server before production, keep an allow-list, and log every prompt and tool call so unexpected SQL, outbound traffic or tool invocations surface in the transcript.

On 15 September OpenAI released GPT-5-Codex, a version of GPT-5 further trained with reinforcement learning on real-world software engineering work, as the default for Codex cloud tasks and code review and selectable in Codex CLI and the IDE extension. OpenAI reports 74.5% on SWE-bench Verified, refactoring performance at 51.3% against 33.9% for GPT-5, and 93.7% fewer tokens than GPT-5 on lightweight interactions. There is no router under the hood: the model reallocates its own reasoning time during a task rather than fixing a budget at the outset, and Codex product lead Alexander Embiricos said he has seen it work more than seven hours on a large job.

It rolled out to ChatGPT Plus, Pro, Business, Edu and Enterprise users across terminal, IDE, GitHub, web and the ChatGPT mobile app, with Codex generating citations, terminal logs and test results per task. A GPT-5 system-card addendum published the same day describes specialized safety training for harmful tasks and prompt injection alongside product-level mitigations: agent sandboxing and configurable network access. OpenAI states plainly that Codex code review should be an additional reviewer, not a replacement for human review.