OpenAI and Anthropic investigations reveal gaps in AI agent monitoring and safeguards

Posted in Commentary with tags , on October 27, 2026 by itnerd

New investigations into OpenAI and Anthropic AI agents have identified failures in monitoring and safeguards that could allow autonomous systems to take unauthorized actions. According to research from METR, independent evaluators discovered vulnerabilities in OpenAI’s internal monitoring system that could allow agents to conceal hundreds of actions, bypass sandbox restrictions and operate with users’ permissions.

Separately, the UK’s AI Security Institute (AISI) found that Anthropic’s Mythos 5 continued pursuing unauthorized attacks against real people during a July evaluation, even when presented with evidence that its actions could cause harm. The agent submitted malicious code to a public GitHub project and created fake identities to pressure a maintainer into approving it.

METR’s findings concerned OpenAI’s monitoring system as it existed in July. OpenAI says it has patched the identified production vulnerabilities, although researchers have not independently verified the fixes. AISI reported no real-world harm from the Mythos incident but warned that flawed AI reasoning could make dangerous behavior harder to detect.

ㅤJohn Strand, Owner, Black Hills Information Security:

“I think we have two separate problems, and the second one isn’t getting nearly enough attention.

“The first is the environment where these agents are being evaluated. We’re talking about sandboxing, but for these highly dangerous offensive AI models, I think an air gap is the only setup we should consider secure. Even then, I’m not completely certain. Models being evaluated for offensive security assessments should have absolutely no internet access.

“People will say they need certain tools. Fine. Give them the tools. We can reasonably predict what they’ll need because they use the same tools security researchers use. Get those tools into an isolated environment and contain the model. A crowbar in a sandbox. That’s what we should be shooting for.

“The second problem is morality and alignment. When you ‘obliterate’ a model and remove its boundaries, those boundaries don’t disappear only for authorized security research. From what’s being described, we’re seeing models attack sites without authorization, including German sites, healthcare sites, and Hugging Face.

“We need better ways to develop and evaluate models that can perform offensive security research within an authorized scope while retaining the boundaries that keep them from hacking unrelated third parties. Permission to attack a lab should not become permission to attack the internet.

“That seems to be a difficult problem for vendors to work through. But it needs to be a much bigger part of this conversation.”

ㅤ

Darin Fredde, Sr. Director of Technical Marketing Engineering, Ridge Security:

“These investigations expose an important gap between what autonomous AI agents can accomplish and what organizations can constrain and verify. The researchers identified different problems, but both reinforce the same principle: an agent’s ability to complete a task doesn’t mean it understands or will respect the boundaries of its authority.

“In offensive security, autonomy is valuable precisely because an agent can explore attack paths that humans might overlook. But that capability must operate within enforceable rules of engagement. Target scope, permissions, network access, and stop conditions cannot depend solely on the model’s interpretation of instructions. They need independent technical enforcement, monitoring, and verification.

“An autonomous agent may be an excellent penetration tester, but it shouldn’t get to rewrite its own rules of engagement.

“I also see something positive here. Independent researchers were given meaningful access to examine these systems, and the findings were disclosed. That’s how security improves. The objective isn’t to slow innovation; it’s to ensure our ability to verify and govern autonomous systems advances alongside their capabilities.

“Ultimately, the measure of security isn’t whether an agent says it stayed within scope. It’s whether we can independently prove that it did.”

ㅤ

Ryan McCurdy, Vice President of Marketing, Liquibase:

“These findings point to one of the most important architectural requirements of the agentic era. AI agents can reason, generate code, and make decisions based on probabilities. That’s incredibly powerful but probabilistic reasoning alone isn’t enough when those agents can take consequential actions in production systems.

“We need deterministic controls around execution. The same standards should apply to every change, whether it originates with a developer, a pipeline, or an AI agent, including authorization, policy compliance, validation, and any required approvals. Those decisions need to be enforced independently of the agent, not left to the agent’s own judgment.

“We also need to know what happened afterward, including what changed, who or what initiated it, whether it complied with policy, and whether the system has drifted from its expected state. Those requirements don’t change just because the actor initiating the change is no longer human.

“Ultimately, the measure of success isn’t how much code agents generate or how many tasks they complete. It’s how much work makes it into production correctly, without constant human intervention. You can’t achieve that at scale without consistent, enforceable controls.”

ㅤ

Seemant Sehgal, Founder & CEO, BreachLock:

“The question of whether agent providers can be the primary line of defense for agent behavior has been open for a while. This research demonstrated that one leading agent could conceal hundreds of actions from its provider’s own monitoring, and another kept pursuing an attack against a real person after being shown evidence of harm. They cannot be the primary line, and organizations running agents in production need their own controls at the orchestration layer rather than inheriting whatever the provider has in place.

“If alignment did not stop the Mythos agent from pressuring a maintainer with fake identities and malicious code after being shown evidence of harm, security teams relying on these models need to ask their providers what alignment actually stops in practice. Pentesting agent deployments against those same conditions, including adversarial inputs and pressure tactics, is the way to find out whether your own agents behave the way you think they do.”

ㅤThis continues to show that AI needs to be under lock and key as letting it run wild doesn’t work out well.

Leave a comment »

Microsoft issues emergency .NET patches

Posted in Commentary with tags on October 27, 2026 by itnerd

Microsoft has released emergency security updates for .NET 8, 9, 10 and 11 to address multiple vulnerabilities, including a buffer overflow flaw that could allow unauthenticated attackers to access or corrupt application memory.

The critical buffer overflow vulnerability, CVE-2026-111497, affects all platforms and could lead to information disclosure, denial of service or privilege escalation. Microsoft also patched CVE-2026-114148, a Linux vulnerability that could allow local attackers to modify files and gain elevated privileges.ㅤ

Microsoft additionally reissued fixes for two vulnerabilities after discovering that its October 13 updates had not fully addressed them. The company urged immediate patching, noting that organizations running self-contained applications or containers must rebuild and redeploy them rather than simply updating their systems.

ㅤDenis Calderone, Principal / CTO, Suzu Labs:

“Organizations that did everything right on October 13 are still running vulnerable code, and Microsoft’s own advisories say so. The flaw is getting the headlines, but the detail that should stop security teams cold is that CVE-2026-70197, the SocketAsyncEventArgs memory corruption fix, was disclosed in the October 13 advisory but never made it into that release. The Blazor WebAssembly debugger fix the same day, CVE-2026-102870, shipped with a packaging error that kept the corrected component from reaching machines. Unfortunately, we have two vul announcements, but neither got fully delivered.

“This lands in an awkward spot for the patching process most organizations actually run. CVE-2026-70197 is an unauthenticated out-of-bounds write in the socket layer, and the new Brotli flaw, CVE-2026-111497, is an out-of-bounds write in a decompression library embedded across .NET 8 through 11. Anyone relying on a patch report dated October 13 has been carrying a false green light for almost two weeks, and a version check would not have caught it, because on paper those deployments looked current. When the vendor’s release notes are the source of truth and the source of truth was wrong, verification has to mean more than a version number.

“The operational part turns this from a bad afternoon into a bad week. Self-contained applications and containers bundle the .NET runtime inside the artifact, so installing the October 25 update on the host changes nothing for them. They have to be rebuilt and redeployed. Ask yourself whether you can list, right now, which applications in your environment are self-contained versus framework-dependent, and where they run. Most can’t, and that inventory gap is what turns a one-day emergency patch into a two-week project.

“So, you should be updating the runtimes, rebuilding and redeploying every self-contained application and container, and updating the Blazor NuGet packages directly instead of trusting the shared runtime. For anything that can’t be rebuilt this week, the Brotli exposure has a configuration work around. The work around is simple enough. Brotli decompression is off by default, so the first question is whether you turned it on anywhere. If you did, remove “br” from request decompression and drop Brotli from HttpClient automatic decompression. That is a config change you can ship in hours, and it is your bridge until the rebuild lands. Then confirm the runtime version actually running in production, not the one in the change ticket. The teams that verify just had a better two weeks than the teams that checked a box.”

ㅤ

John Strand, Owner, Black Hills Information Security:

“This story almost feels like Microsoft saw the PHP vulnerabilities, looked around, said, ‘Hold my beer,’ and handed us these .NET vulnerabilities.

“It’s been bad. Apparently, Black October isn’t done yet. These critical .NET vulnerabilities look like they’re hitting a large section of the websites that the PHP vulnerabilities missed.

“I do wonder if there were some .NET developers and Microsoft website maintainers feeling a little smug last week, thinking, ‘Well, good thing we weren’t running PHP.’ Now they have their own critical vulnerabilities to deal with.”

ㅤ

Seemant Sehgal, Founder & CEO, BreachLock:

“When vulnerabilities like CVE-2026-111497 are left unpatched, an attacker exploiting this chain can start with memory corruption inside a vulnerable .NET process, escalate privileges against the service account running it, and inherit whatever reach that account has. Enterprises typically grant those accounts more reach than they need.

“Teams that already know what runtime versions are running in production and who owns each one will patch this fast. The rest should start that inventory work now.”

ㅤIf you rely on .NET, you need to patch all the things and do it fast.

Leave a comment »

New maritime cybersecurity database identifies nearly 30,000 vulnerabilities affecting ships and ports

Posted in Commentary with tags on October 26, 2026 by itnerd

A new maritime cybersecurity initiative has identified nearly 30,000 vulnerabilities relevant to ships, ports and offshore infrastructure, according to the newly launched Blue Initiative, a collaboration led by Cydome Security and maritime industry partners.

The database currently tracks 29,505 vulnerabilities, including 2,004 rated critical and 586 listed in CISA’s Known Exploited Vulnerabilities catalog. It also identifies 37 maritime-specific vulnerabilities affecting systems built for ships and ports.

The initiative categorizes vulnerabilities across navigation, propulsion, communications, industrial controls and onboard IT systems, helping operators identify which flaws affect their equipment. It also provides alerts for newly disclosed critical vulnerabilities and those known to be exploited.

John Strand, Owner, Black Hills Information Security:

“This is another example of how we fail to look at the interconnectedness of all the devices we use. I think this maritime report is fantastic because it examines vulnerabilities from end to end across an entire ecosystem, in an industry that has traditionally been underserved by the security community.

“When we look at ships, cranes, and the systems moving cargo in and out of ports, we tend to treat them as things. We don’t think about whether they need endpoint detection, a firewall, or patches and updates. It’s just a device attached to a widget. We forget about the whole ecosystem that makes it work.

“That’s why this case study matters. Take the same approach to military systems, medical devices, or pharmaceutical manufacturing, and I think we’d probably find very similar problems. We depend on these connected devices, but we still don’t consistently treat them as computer systems that need to be secured.”

ㅤ

Seemant Sehgal, Founder & CEO, BreachLock:

“A database of 29,505 vulnerabilities is noise until an operator knows which of them are actually reachable and exploitable in their environment. Severity counts and KEV listings only answer part of the question. What matters for any single operator is how many of those vulnerabilities an attacker could actually reach on their fleet, their ports, and their offshore assets.

“That question manually at this scale. The combination of distributed assets, long operational windows between port calls, mixed IT and OT environments, and limited onboard security staffing means any approach that depends on human analysts triaging thousands of CVEs will fall behind the exposure before the next voyage begins. The scalable version is continuous testing of what an attacker could actually reach across the fleet, so when a critical CVE lands, the operator already knows which vessels and which systems are exposed and which are not.”

Let’s see how well this works out. I say that because having a database is good. But actioning the information in it on a consistent and quick basis is much better. And actioning it with everything is the best possible outcome.

Leave a comment »

AI robocalls + NFC relay drained €380K in Dutch bank scam

Posted in Commentary with tags on October 26, 2026 by itnerd

Dutch police arrested two men who drained more than €380,000 from 170 bank customers using AI-generated robocalls. The recordings warned of suspicious account activity, then a live “bank employee” took over and talked victims into installing an app and holding their debit card to the phone. The app captured the card’s NFC data and relayed it to an accomplice waiting at an ATM.

Rohan Gupta, CEO & Co-founder, Diopter Had This To Say:

“Based on the reporting, this was a familiar social engineering playbook with AI running the first step. An AI-generated recording warned people about suspicious activity on their bank account and asked them to press 1 if it wasn’t them, establishing authority and urgency. A live caller posing as a bank employee then took over, said the card had been blocked, and had them download an app and hold the card to their phone. An AI voice was the thing that allowed a two-person crew to run that first step at scale, and it looks like it cost 170 people more than €380,000. Businesses should expect the same approach on their own phone lines, from callers who sound just like their bank or one of their vendors. Any request to install software, move money, or share a login is a red flag even if the caller sounds like someone you know. Your bank should never ask you to tap your card to your phone during a call. If that happens, best practice is to hang up and call the number on the back of your card.”

Social engineering has got a new life thanks to AI. Thus people need to be educated about this new but old threat that is out there.

Leave a comment »

PHP2Shell security flaws now successfully exploited in the wild

Posted in Commentary with tags on October 26, 2026 by itnerd

Two critical remote code execution vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, have now been confirmed as successfully exploited in the wild. Adel Karimi, detection and response lead at Perplexity, captured evidence of successful exploitation against an Apache mod_php installation running PHP 8.4.26, including memory disclosure and subsequent command execution. The findings, corroborated by security researcher Marcus Hutchins, mark a significant escalation from earlier reports of scanning and unsuccessful exploitation attempts.

Bri Frost, Director of Product Management, Cloud Range said this:

“PHP2Shell highlights a challenge that security teams increasingly face: exploitation can begin before defenders have complete information about a vulnerability, its impact or even whether available mitigations are effective. In these situations, the biggest risk isn’t necessarily a lack of security tools. It’s whether the people responsible for responding can make the right decisions quickly under pressure.

“Organizations should be testing how their security teams respond when a critical vulnerability moves from theoretical risk to active exploitation. Can analysts distinguish scanning from successful compromise? Can they identify suspicious activity on affected servers, determine whether attackers have established persistence and coordinate containment without unnecessarily disrupting business operations? These are skills that need to be developed through realistic exercises, not figured out during an actual incident. The faster exploitation timelines become, the more important it is that security teams have already practiced responding to situations where the threat is evolving faster than the available intelligence.”

If you haven’t fixed or replaced any application that uses PHP, now is a really good time to do so. Though based on this, it might be too late already.

Leave a comment »

New FIRE Analysis: Inside an Active ChatGPT Billing Phishing Campaign

Posted in Commentary with tags on October 26, 2026 by itnerd

New research from Fortra Intelligence and Research Experts (FIRE) dives deeps into an active campaign using fake ChatGPT Plus billing emails, revealing the infrastructure and mechanics keeping it running.

Key findings include:

  • Live operators control victim sessions and can escalate from card theft to OTP/2FA capture.
  • Identical code and shared identifiers connect independently deployed phishing sites.
  • Short-lived sites are replaced while the underlying operation continues.
  • The phishing kit is evolving, with newer instances showing changes to its front end.

The analysis shows how a familiar phishing lure has become a repeatable, operator-driven payment-card theft operation.

Full analysis was just published here: https://www.fortra.com/blog/anatomy-openai-phishing-kit-rotating-wordpress-hosts-live-operators-and-otp-theft

Leave a comment »

Takeaways From ‘Black October’

Posted in Commentary with tags on October 26, 2026 by itnerd

This month was coined ‘Black October’ by the infosec community, following the onslaught of widespread and critical vulnerabilities and security incidents, such as P2PShell, the LiteLLM suplly chain attack and the eMhudra certificate compromise.

Allen Houchins, CIO, Fleet Device Management

“Black October exposed a lack of visibility into their own environments as a major weakness in how organizations respond to emerging security threats.

With incidents like PHP2Shell and the eMudhra certificate compromise, security teams were immediately faced with two questions: where are we exposed, and how quickly can we fix it? Neither question should take days to answer.

There are three key lessons organizations should take away:

  1. Know what’s running across your entire environment: IT and security teams need a complete, real-time inventory of every workstation and server, including installed software and configurations. When a new vulnerability emerges, organizations should be able to identify affected devices in seconds, rather than waiting hours or days for inventory scans and reports.
  2. Make remediation as fast as detection: Finding vulnerable systems is only the first step. Organizations need the ability to push patches, configuration changes and other fixes across their entire environment quickly, without waiting hours or days for policies to take effect. The longer that gap remains open, the greater the opportunity for attackers.
  3. Prepare to respond at AI speed. without sacrificing oversight: Automated workflows, GitOps and infrastructure-as-code approaches can help organizations deploy changes rapidly while ensuring every action is documented, reversible and verified by a human before deployment.

Ultimately, Black October is a reminder that knowing about a vulnerability is only half the battle. The real measure of security readiness is how quickly organizations can identify where they’re exposed, take action and verify that the issue has been resolved.”

Hopefully November is better as I can’t deal with another October.

1 Comment »

Claude Accessed Georgia State Voter Count Data –

Posted in Commentary with tags on October 26, 2026 by itnerd

AI model Claude bypassed a paywall ​and accessed publicly available US ‌state of Georgia aggregate voter counts without human authorization. Which is of course bad. More info here: https://www.reuters.com/world/us/anthropics-claude-accessed-public-us-state-georgia-voter-information-axios-2026-10-25/

Erin Hamm, Chief Data Officer DataBee, A Comcast Company:

“This is not a story about a single model or a single agent. It is a story about the gap between what is available and what is authorized. The data was public but it sat behind a fee. Any person would have understood that fee as a boundary. An agent treated it as an obstacle. Access control tells you who is allowed in. It says nothing about what a system will decide to do in order to finish its assigned task. Most organizations are still governing agents the way they govern users. They set permissions, write a policy, and assume intent will follow. Agents have goals, not intent. A goal plus a path that is reachable is enough for that agent to cross the boundary a human wouldn’t.”

Scott Miserendino, Chief Technology Officer DataBee, A Comcast Company:

“This hardly qualifies as hacking. The AI used an existing public endpoint to create a visitor account. The Georgia State agency responsible for the website should have fully deprecated the older versions of the website that allows for free visitor access if they no longer wished to support it. The AI did not do anything nefarious here. It was just thorough in its attempt to complete a legitimate task.”

Dan Moore, Sr. Director CIAM Strategy at cybersecurity company FusionAuth:

“Strip away the sensational AI headline and you have a basic authorization flaw: the server confirmed a visitor held a token, but never checked if they’d actually paid for what it unlocked.

Most systems end up full of blind spots like this simply because they were never worth a person’s time to dig up. An unused, forgotten endpoint, an inconsistent permission check, a paywall enforced on the front page but missed on a deep link. Flaws like that go unnoticed for years because no one invested time to look for them.

People are now using AI agents to find these vulnerabilities. What were previously edge cases that required multiple steps too time-consuming for a human to undertake are now easy and cheap for AI agents to find. You no longer need a skilled, dedicated attacker targeting your application—an automated tool can find the gap through sheer volume and patience. This makes the access-control cleanup everyone knew they should do but put off to deliver revenue generating features a lot more urgent.”

I’ve always believed that AI needs to be locked up and restricted in terms of what it can do. This highlights that I was right about that..

Leave a comment »

Ridge Security Is the Only Vendor Listed Across Four Categories in Three Gartner Cybersecurity Reports

Posted in Commentary with tags on October 26, 2026 by itnerd

Ridge Security has been included in four cybersecurity technology categories across three Gartner research reports, we believe it’s reflecting the growing focus on validating security defenses and identifying exposure before attackers can exploit it.

The reports include:

  • Adversarial Exposure Validation: Market Guide for Adversarial Exposure Validation lists Ridge Security for its RidgeBot in its table of Representative Vendors.
  • Agentic Red Teaming: Emerging Tech Impact Radar: Preemptive Cybersecurity includes Ridge Security among its Sample Vendors.
  • Unified Exposure Management Platforms: Emerging Tech Impact Radar: Preemptive Cybersecurity report includes Ridge Security among its Sample Vendors.
  • Agentic AI for Security: Emerging Tech Impact Radar: AI Cybersecurity Ecosystem includes Ridge Security among its Sample Vendors.

Together, these categories reflect a broader shift in cybersecurity toward more continuous, automated ways to test defenses, understand exposure and identify weaknesses before they can be exploited.

Ridge Security’s portfolio includes RidgeBot®, its automated penetration testing platform; RidgeGen™, its agentic AI platform for autonomous security testing and red teaming; and RidgeOne, an “AI Pentesting in a Box” solution that combines RidgeGen with a locally running AI model on NVIDIA DGX Spark. Together, these solutions help organizations identify vulnerabilities, validate attack paths and better understand their exposure, and determine how to remediate security issues. RidgeOne extends autonomous testing into environments where data privacy, infrastructure requirements and AI costs are key considerations.

Attribution and Disclaimer:

Gartner®, Market Guide for Adversarial Exposure Validation, Dhivya Poole et al., 24 March 2026

Gartner®, Emerging Tech Impact Radar: Preemptive Cybersecurity, Elizabeth Kim et al., 11 September 2026

Gartner®, Emerging Tech Impact Radar: AI Cybersecurity Ecosystem, David Senf et al., 5 October 2026

GARTNER is a trademark of Gartner, Inc. and its affiliates.

Gartner does not endorse any company, vendor, product or service depicted in its publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner publications consist of the opinions of Gartner’s business and technology insights organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this publication, including any warranties of merchantability or fitness for a particular purpose.

Leave a comment »

Hisense unveils new C3 projector family for immersive home entertainment

Posted in Commentary with tags on October 26, 2026 by itnerd

Hisense, is expanding its home entertainment portfolio with the new C3 projector family, designed to bring cinema-sized entertainment into everyday life.

Showcased at IFA 2026 in Germany, the C3 Ultra and C3 Ultra Max are launching across global markets this September, with the C3 Pro set to follow. From movie nights and live sports to gaming with friends, the C3 family is designed around the moments people want to make bigger. With projection sizes of up to 300 inches, powerful brightness and immersive sound, it transforms living rooms, bedrooms and other spaces into flexible entertainment destinations, giving users more freedom to enjoy the big-screen experience at home.

The C3 Ultra delivers 4,000 ANSI lumens and a 5,000:1 contrast ratio with an IRIS Lens, combining vivid visuals with gaming-enhanced performance. Its Devialet-tuned audio system, featuring co-engineered hardware and a built-in subwoofer, delivers deep bass and immersive surround sound for a more engaging entertainment experience.

For users seeking greater visual power and responsiveness, the C3 Ultra Max delivers 5,000 ANSI lumens, 5,000:1 contrast with an IRIS Lens and 1ms ultra-low latency, supporting dynamic entertainment across movies, sports and gaming. Enhanced by Devialet audio, it completes the experience with rich, immersive sound that matches its high-performance visuals.

The C3 Pro brings the C3 experience to more users with 3,000 ANSI lumens, 5,000:1 contrast with an IRIS Lens and Devialet-tuned audio with a built-in subwoofer, offering a compelling balance of performance and value.

Together, the C3 Ultra, C3 Ultra Max and C3 Pro further enrich the C3 family, offering consumers a broader range of choices to suit different entertainment needs and spaces. Earlier this year, the C3 has undergone Life Cycle Assessment (LCA) and product carbon footprint (PCF) verification by SGS, supporting transparent evaluation of environmental impact across the product lifecycle and reflecting Hisense’s commitment to transparent product-level environmental assessment.

With the C3 family, Hisense continues to bring more immersive entertainment into everyday spaces, making it easier for people to turn ordinary moments at home into experiences worth sharing.

For more information, please visit hisense-canada.com.

Leave a comment »

« Older Entries
Newer Entries »