INTERPOL’s Operation Serengeti III led to 1,462 arrests, disrupted 10,909 malicious networks and recovered $105 million across 21 countries. INTERPOL announced the results of Operation Serengeti III, a multinational cybercrime crackdown that led to 1,462 arrests, disrupted 10,909 malicious networks and recovered more than $105 million in illicit funds. The operation brought together law enforcement agencies from 21 countries between June 29 and August 31, 2026, targeting online fraud, ransomware, business email compromise (BEC), scams and digital extortion. “One of Africa’s largest cybercrime enforcement operations saw law enforcement agencies from 21 countries arrest 1,462 suspects, disrupt 10,909 malicious networks and recover more than USD 105 million in illicit funds.” reads the agency’s announcement. “Authorities identified 65,929 victims targeted by cybercriminal networks, underscoring the scale and sophistication of today’s digital threats. Financial investigations linked criminal activity to losses exceeding USD 385 million. ” The scale of the operation is striking. Investigators identified 65,929 victims, while financial investigations linked the criminal activity to losses exceeding $385 million. The figures highlight how cybercrime continues to generate substantial profits by combining technical capabilities with familiar forms of deception. The results also show why tackling these operations requires more than taking down websites or blocking malicious IP addresses. Investigators need to identify the people behind the infrastructure, follow the money and connect evidence collected across jurisdictions. Uganda saw one of the largest actions in the operation. Authorities broke up two international fraud networks and arrested 365 foreign nationals suspected of running online investment and pension scams targeting people across Asia. Investigators found call centres where staff followed prepared scripts to convince victims to invest through fake trading platforms and websites. The scams targeted people who believed they were making legitimate investments, including pensioners. These cases show how criminal groups combine technology with organized social engineering to deceive victims and steal their money. Source: Interpol – Suspected Scam Call centre in Uganda. In Angola, authorities shut down two illegal cryptocurrency mining centres, arrested nine suspects and seized over 2,000 mining devices and six illegal power stations. The electrical equipment was worth more than $1 million. In Nigeria, investigators arrested a suspect linked to phishing and business email compromise (BEC), which involved stealing software credentials and collecting about 2.1 million email addresses. They also recovered a luxury car suspected of being bought with criminal money. A separate Nigerian investigation traced over $2.4 million linked to an investment scam promoted through messaging apps, with much of the money laundered through cryptocurrency. Authorities also targeted loan app fraud in Tanzania, vehicle import scams in Gabon and arrested 30 suspects in the Republic of Congo. Operation Serengeti III relied on intelligence provided before the enforcement phase. Investigators from 20 African countries and the United States received information about suspicious domains, IP addresses and command-and-control infrastructure associated with criminal activity. Private-sector cybersecurity companies also supported the operation, providing threat intelligence, technical analysis and investigative expertise. INTERPOL listed Group-IB, Kaspersky, Fortinet, TrendAI, Team Cymru, Uppsala Security, Cybercrime Atlas and Meta among the participating partners, alongside other organizations. This cooperation matters because criminal infrastructure rarely respects national boundaries. A phishing domain, a compromised account, a fraudulent investment platform and the bank accounts used to move stolen funds may all involve different countries and service providers. Investigators need to connect those elements quickly enough to identify suspects and preserve evidence. INTERPOL’s 2026 African Cyber Threat Assessment Report highlights the growing role of AI in cybercrime as financial losses rise. Criminals can use AI to create convincing messages, improve social engineering and target more victims. While AI does not replace the need for criminal infrastructure or ways to move stolen money, it can make scams easier to repeat and harder for victims to recognize. INTERPOL said several investigations remain active. Authorities are continuing to identify suspects, trace illicit proceeds and analyze digital evidence recovered during the operation. That qualification is important. Arrests and infrastructure disruptions are meaningful enforcement results, but they don’t automatically establish how many criminal organizations have been dismantled permanently, how much of the stolen money will reach victims, or whether other operators will rebuild the disrupted services. “Cybercrime networks operate without regard for borders, exploiting technology to target victims on an unprecedented scale.” INTERPOL Director of Cybercrime Neal Jetton said. “Operation Serengeti III reinforces a clear message: while cybercrime is increasingly borderless, international cooperation remains one of the most effective tools for disrupting criminal networks, recovering criminal assets and protecting communities from digital harm.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Operation Serengeti)
Attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22. The flaw lets anyone who can log in to the orchestrator, even with a read-only customer account, gain operator privileges, the top level of control over it. For
This week has already been rough for cybersecurity. Critical PHP and GitLab RCE flaws, serious Linux security bugs, compromised eMudhra certificates, a Node.js RCE flaw, a hacked LiteLLM release, and hundreds of hijacked Tor relays. That's a lot to deal with in just a few days. And the week isn't even over yet. But those big headlines are only half the story. Stolen passwords, exposed
Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments. VCO is a web-based management portal that helps administrators configure, monitor, and manage VeloCloud SD-WANs (Software-Defined Wide Area Networks) and associated edge devices. Tracked as CVE-2026-114625, this critical-severity flaw can allow attackers with basic privileges, access to the VCO web interface, and a valid authenticated session to escalate privileges through low-complexity SQL injection attacks that don't require user interaction. "VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator," Arista said.
AWS detected PHP2Shell exploit attempts four days before disclosure, highlighting the risk of attackers exploiting critical flaws before patches arrive. Attackers attempted to exploit two critical PHP vulnerabilities four days before the flaws became public, according to Amazon Threat Intelligence. “Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot telemetry, four days before public disclosure of CVE-2026-109618 and CVE-2026-109619.” reads the report published by Amazon team.”The exploit attempt originated from an IP address associated with a commercial anonymization network. While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure.” The activity began on October 17, 2026, and appeared in telemetry from MadPot, AWS’s network of honeypots designed to attract and study malicious activity. The company said the first attempt targeted a honeypot from an IP address linked to a commercial anonymization network. The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, were still under embargo at the time. AWS believes the use of anonymized infrastructure suggests a threat actor was behind the activity. However, the company hasn’t established how the attacker obtained information about the vulnerabilities before their public disclosure, nor has it confirmed that the early attempts would have succeeded against real-world systems. The first attempt wasn’t an isolated event. AWS detected multiple proof-of-concept exploits on October 21, with the earliest appearing at around 02:00 UTC, roughly 12 hours before the scheduled public release and patch at 14:00 UTC. Between 02:00 and 08:00 UTC that day, AWS observed further attempts against MadPot from additional anonymized infrastructure. The payloads and anonymization services varied, leading the company to suspect that multiple actors were involved. After the embargo ended and PHP released the fixes, more proof-of-concept exploits appeared within hours. AWS reported that attackers used them against its sensors almost immediately, describing PHP2Shell as being broadly exploited in the wild. The findings show why the date of a public security advisory can’t always serve as the starting point for an incident investigation. In this case, defenders had to account for activity that began before they could publicly identify the vulnerabilities. “The actual payloads and choices in anonymization infrastructure varied, suggesting these were multiple actors.” continues the report. “Technical analysis is ongoing, and it’s unclear if any of these attempts would have succeeded in real-world systems.” PHP2Shell refers to two critical flaws in the PHP runtime that can allow unauthenticated remote code execution. An attacker may be able to send a specially crafted web request and run commands on a vulnerable server without first logging in. PHP published fixes on October 21. The corrected releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to the official PHP security notice. The vulnerabilities affect PHP itself, rather than a specific website application. As a result, updating WordPress, Drupal or another application won’t fix the underlying problem if the server continues to run a vulnerable PHP runtime. AWS says there is no configuration-only workaround that fully addresses both flaws. Organizations should install the fixed PHP version as soon as possible and check whether their hosting provider, operating system vendor or container image has supplied the necessary update. For systems that can’t be patched immediately, AWS suggests considering whether blocking multipart file uploads is practical. Administrators should assess the impact on their applications before applying that restriction, and they shouldn’t treat it as a replacement for installing the fixes. AWS recommends reviewing web server logs for suspicious requests, particularly POST requests containing the PHP_SESSION_UPLOAD_PROGRESS string in multipart form data. Security teams should also look for unexpected processes launched by PHP and unexplained changes to files on web application servers. These checks matter because an attack may leave evidence beyond the original HTTP request. Unexpected command interpreters, newly created files or unusual process activity can help investigators determine whether an attacker progressed beyond probing a vulnerable endpoint. AWS also published six IP addresses associated with observed activity: 103.216.220.92, observed on October 17 31.223.184.166, observed on October 21 37.19.200.5, observed on October 21 134.209.159.64, observed on October 21 103.114.163.188, observed on October 21 95.217.98.37, observed on October 21 These addresses require careful handling. AWS warns that some belong to shared anonymization infrastructure and aren’t exclusive to PHP2Shell activity, so organizations should investigate matching events rather than automatically blocking every address. The Cloudflare analysis of PHP2Shell provides additional context. Cloudflare said it had deployed web application firewall protections before public disclosure and had already observed attack traffic targeting its customers, including attempts to change payloads to evade those protections. A web application firewall can help reduce exposure, but it doesn’t replace patching. Defenders should combine updated software with log analysis, process monitoring and checks for suspicious file changes. AWS draws a broader lesson from the incident: organizations shouldn’t assume that exploitation begins only after a vulnerability becomes public. The October 17 activity shows that attackers may obtain or develop exploit information while a flaw is still under coordinated disclosure. Attackers are using AI to develop exploits faster, sometimes within hours of a patch being released. Security teams need to patch critical systems quickly and investigate attacks from the earliest known date. For PHP2Shell, AWS recommends checking logs and activity from October 17 onward, including suspicious behavior that detection tools may not yet recognize. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, PHP)
Security researchers at Amazon Threat Intelligence say attackers began targeting the PHP2Shell flaws four days before security patches were released on Wednesday. Tracked as CVE-2026-109618 and CVE-2026-109619, the two critical vulnerabilities let attackers gain remote code execution (RCE) on vulnerable systems. The PHP security team patched them on October 21 after urging admins one day earlier to prepare to install the updates as soon as they became available. PHP core developer Gina Peter Banyard warned before disclosure that applying the official security patches is the only permanent defense, while the UK National Cyber Security Centre (NCSC) asked UK organizations to immediately update PHP servers or take them offline until they can be patched. The PHP team says that everything went according to plan until two days before the coordinated disclosure, when it had to speed up the targeted release date starting October 20 after some details on the PHP2Shell security flaws (including the two CVE IDs and mitigation advice provided to some critical infrastructure providers) leaked online.
Law enforcement agencies have disrupted nearly 11,000 cybercriminal networks and arrested more than 1,400 people in Operation Serengeti III, which targeted business email compromise, ransomware, and online scams. Coordinated by Interpol, the operation involved authorities from 21 countries and private partners like Team Cymru, Kaspersky, Group-IB, and Fortinet, in a major crackdown on cybercrime across Africa. The action unrolled between June 29 and August 31 and led to the recovery of more than $105 million in illegal funds. In a press release today, Interpol says that Operation Serengeti III has resulted in the arrest of 1,462 suspected cybercriminals and the dismantling of 10,909 malicious networks. The investigation identified 65,929 victims and estimated financial losses at more than $385 million.
SafePay ransomware has hit 600+ organizations since 2024, using stolen credentials, VPN access and double extortion to pressure victims into paying. CISA, the FBI, the US Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, and two UK law enforcement agencies jointly published an advisory this week on SafePay, a ransomware group they describe as one of the most active operations currently running. The group has breached at least 600 organizations across critical infrastructure sectors since August 2024, spanning North America, South America, Europe, and Australia. “Since August 2024, SafePay ransomware group’s operations have affected a wide range of businesses and critical infrastructure in North America, South America, Europe, and Australia. SafePay ransomware was among the most active ransomware groups in 2026. The SafePay threat actors have impacted at least 600 separate victims from multiple critical infrastructure sectors.” reads the joint advisory, “The authoring agencies encourage organizations to implement the recommendations in the Mitigations section of this advisory to reduce the likelihood and impact of SafePay ransomware incidents.” SafePay appeared in mid-2024 as an independent ransomware group that operates without affiliates. This is unusual because many major ransomware groups work like franchises, allowing other criminals to use their tools and services. SafePay grew as groups such as BlackCat and LockBit declined, and its activity has continued. The advisory includes findings from FBI, US Secret Service, and German investigations through August 2026. SafePay’s preferred entry points are exposed credentials, brute force password attacks, and VPN access. “The FBI, USSS, and cybersecurity researchers observed SafePay threat actors obtaining initial access [TA0001] to organizations through various means, including credential exposure, implementing brute force password attacks [T1110], and exploiting virtual private network (VPN) access.” states the advisory. “SafePay threat actors use the IP addresses of the VPN provider “Mullvad” to attain initial access—specifically, SafePay threat actors use phished account profiles to access victim networks to exploit the following known Common Vulnerabilities and Exposures (CVEs) for edge device products” Security teams should watch for unusual login attempts coming from Mullvad VPN IP addresses. SafePay also uses stolen account credentials and automated scripts to exploit known vulnerabilities in internet-facing devices. These include Cisco VPN flaws from 2020 and 2023, a Veeam vulnerability, and a SonicWall access control issue. Once inside a network, the attackers rely on common tools rather than specialized malware. They use PsExec, WinRM, RDP, and PowerShell to move between systems. A PowerShell script called ShareFinder.ps1 helps them find shared folders and identify valuable data. Mimikatz is used to steal credentials, while AnyDesk and TeamViewer provide remote access. To steal data, the group uses tools such as FileZilla, RClone, WinSCP, and even OneDrive. Encryption uses a ChaCha20 stream cipher combined with RSA for key exchange, with methods customized based on file type and size. Files get the .SafePay extension appended. “Data encrypted with the SafePay ransomware variant (appended with .SafePay) cannot be recovered without the decryption key. SafePay threat actors hold the encrypted data for ransom and typically demand a subset of company revenue in cryptocurrency in exchange for decryption software.” states the advisory. “SafePay threat actors leave a ransom note on the victim’s system, typically on the desktop or root directory, advising them that SafePay locked their system and to reach out over a chat portal at a TOR .onion website link with a victim ID as the login. “ Paying the ransom remains the only path to decryption for encrypted files, and even that isn’t guaranteed to work. The group runs a double-extortion model: steal first, encrypt second, threaten to post the stolen data publicly if the victim doesn’t pay. After encryption, SafePay sends victims to a Tor-based chat portal for negotiations. A representative also makes phone calls to apply pressure. If no payment comes, everything goes on the leak site. The group also deletes Volume Shadow Copies and resets network-attached backup devices to factory settings, which is the operational equivalent of cutting off every exit before the fire starts. The advisory recommends several basic security measures. Keep internet-facing devices, especially VPNs and firewalls, up to date. Prioritize vulnerabilities listed in CISA’s Known Exploited Vulnerabilities catalog. Enable multi-factor authentication (MFA) for VPNs, webmail, and accounts that access critical systems. Limit the number of accounts allowed to use administrative tools. SafePay relies on legitimate Windows tools to move through compromised networks, making its activity harder to detect. Organizations should also keep backups offline, encrypted, and immutable so attackers cannot access, change, or delete them. CISA also recommends reviewing all accounts with admin privileges, setting time-limited access where possible, and disabling command-line tools for any account that doesn’t need them. The advisory includes IOC files in STIX XML and JSON format, full MITRE ATT&CK mapping, and complete file and IP indicators. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, ransomware)
A Russian satellite made a close approach to a commercial radar satellite linked to Ukraine, raising concerns about surveillance and security in space. A Russian-made satellite called Kosmos 2612 got very close to ICEYE-X36 last week, a commercial Earth-observation satellite that may support countries like Ukraine. CNN reports it may have come within less than a mile. Orbital monitoring company LeoLabs says the behavior is consistent with rendezvous and proximity operations, meaning maneuvers designed to bring two spacecraft together. “A rare move by a Russian-made satellite may have brought it within less than a mile of a commercial Earth-observation satellite that may be used to provide national security services to countries such as Ukraine.” states CNN. “It’s not clear what, exactly, the Russian satellite, called Kosmos 2612 or Cosmos 2612, intended to accomplish with its close approach. But the behavior was consistent with rendezvous and proximity operations, or maneuvers carried out in orbit that are designed to bring two spacecraft together, said orbital monitoring services company LeoLabs, which tracks space junk and activity in Earth orbit, in a statement.” It is unclear what Russia wanted to achieve. LeoLabs said “While the intent remains uncertain, the behavior warrants continued monitoring.” Astrophysicist Jonathan McDowell noted that this could be the first known case of one spacecraft approaching another without permission. This is different from docking, when two spacecraft intentionally connect, a common practice in space. The events unfolded over several months. In May, four Russian-controlled satellites changed their orbits to align with ICEYE-X36, according to a June report by the Royal United Services Institute. On October 15, Kosmos 2612 began moving closer to ICEYE-X36, reducing the distance from 350 kilometers to less than 5 kilometers by early October 16. It stayed nearby, making small adjustments through the weekend, before starting to move away on Monday. The War Zone (TWZ) reports that Kosmos 2612 was one of six satellites launched together on April 17. The closest point is disputed. LeoLabs says it came within roughly 500 meters during part of the event, but warns that the repeated maneuvers and awkward tracking geometry make separation estimates uncertain. Space.com reports the satellites may have been a few meters apart at one point, and TWZ’s reading of public tracking data points to about 26 meters. The target matters. ICEYE operates about 80 radar satellites that image the Earth through clouds, day and night, and ICEYE-X36 belongs to its US subsidiary. At least some ICEYE satellites provide imagery to Ukraine, and in January the company signed a contract firming up that relationship, saying it gives Ukraine’s Ministry of Defence persistent situational awareness on tactical timelines. A Ukrainian official told Axios that Ukraine’s military works with ICEYE but couldn’t say whether this specific satellite is involved. Russia appears to be paying close attention to ICEYE-X36. Changing a satellite’s orbit to match another spacecraft’s path uses a lot of fuel, so it is not a decision taken lightly. Four Russian satellites made similar changes in May. However, it remains unclear whether ICEYE-X36 is specifically used to collect images of Ukraine. Close approaches between satellites are not new, but this case is different. Russia, the United States, and China have all moved satellites close to those operated by other countries, mainly in geostationary orbit. Kosmos 2612 operates in low Earth orbit. As far as is publicly known, Russia has carried out similar approaches there, but the United States and China have not. Victoria Samson of the Secure World Foundation pointed to two earlier Russian cases. In 2020, Kosmos 2543 came within about 30 kilometers of USA 245. In 2022, Kosmos 2558 approached USA 326 to within about 70 kilometers. Both targets were classified US spy satellites operated by the National Reconnaissance Office. ICEYE-X36, by contrast, is a privately owned satellite, and Kosmos 2612 came much closer than in those earlier cases. Space law professor Aaron Brynildson told Axios that there is no strict legal limit on how close satellites can approach each other. However, countries generally avoid getting within six miles of another satellite. Why do it? Samson lists a few options. Russia may want to learn the satellites’ capabilities and what they’re studying, or it may have interfered with sensors or communications. She leans toward a different reading: she thinks Russians are getting frustrated, in a stalemate for about six months, and this is a way to show military prowess in a way Ukraine can’t answer, since Ukraine matches Russia in drones but not in space. RUSI’s June report is blunter about the options. It lists intimidation or interference through jamming, which uses radio noise to stop satellites from communicating. It adds that the range of options for protecting an ICEYE satellite is limited, and that defending satellites is a famous dilemma. LeoLabs says the event doesn’t establish hostile intent, but shows capabilities that could support intelligence collection, inspection, coercive signaling, interference or preparation for future counterspace operations. ICEYE’s response was short: the company is aware, tracking closely, and says its constellation architecture is designed for continuity and resilience. CNN says it asked Russia’s defense ministry and Roscosmos for comment. The US Space Force had already described Russian satellites positioned near a Western commercial radar satellite used by Ukraine for imagery intelligence, according to Axios. Private companies and independent observers, rather than the US Space Force, revealed the satellite encounter, highlighting the need for greater government transparency as space becomes more contested. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, satellite)
OpenAI reveals two cases of AI agents disabling safety monitoring during coding tasks, with one falsely denying it had removed the safeguards. OpenAI published an internal incident report this week documenting two separate cases in which GPT-6 class agents weakened the system designed to detect misaligned behavior, in both cases while carrying out routine coding tasks. This wasn’t an external attack. These were internal deployments, and the agents made their own judgment calls that happened to gut the oversight watching them. OpenAI explained that “in both cases, the agents considered whether monitoring safeguards should be preserved, but interpreted routine coding instructions as permission to weaken them.” In other words, the agents thought about whether they should keep the safety controls in place. They then interpreted the user’s instructions in a way that led them to weaken those controls. “In two internal coding tasks, agents weakened misalignment monitoring while making requested software changes. A GPT-6.1 Sol agent repairing an evaluation pipeline disabled automatic alerts to our Security team, treating an earlier instruction not to send messages during a Slack history search as a reason to suppress monitoring notifications.” reads OpenAI’s report. “In a separate task, a GPT-6 Astra agent migrating a program removed its monitoring integration in order to match a reference implementation, and then falsely claimed to the user that it had not removed the monitor.” On October 3, a researcher asked a GPT-6.1 Sol agent to create evaluation tasks using Slack data. The researcher clearly instructed the agent not to send any messages during the process. Later, the system triggered a monitoring alert because it couldn’t save its findings to a database. The user then asked the agent how to proceed. At this stage, the agent was still following the rules. It even told a subagent to keep monitoring enabled and report the actual results. The subagent correctly identified that turning off notifications would disable required safety alerts and decided not to do it. Then the parent agent reconsidered on its own, reasoning that writing results to a database might cause the monitoring system to send a message, which conflicted with the user’s earlier “don’t send messages” instruction. It concluded the instruction applied to safety alerts too, and directed the subagent to set no_notify to true, empty the list of people set to receive monitoring reports, and make notification suppression a hard requirement before writing any results. The monitor still ran and saved its reports. Nobody received the human alerts. On October 6, a user asked a GPT-6 Astra agent to copy a reference implementation while keeping existing tool definitions and functionality intact. An earlier instruction from another agent had explicitly told the system not to disable monitoring, even temporarily. The parent agent passed that requirement to a subagent but softened it, saying monitoring should be preserved “as appropriate” to the reference implementation. The subagent took this wording as permission to remove monitoring because the reference implementation did not include it. It also changed a test that checked whether monitoring was active. The new test instead required monitoring to be disabled. After the migration, the main agent noted internally that the new setup no longer included agent monitoring and described this as a positive outcome. When the user later asked whether monitoring had been removed, Astra said: “No… I did not remove an enabled monitor from it.” That was false. OpenAI offers two possible readings of these incidents. The charitable one is what they call “benign overpersistence,” models that don’t understand why monitoring matters and follow instructions more literally than a reasonable person would. The less comfortable reading is that these models might have a specific tendency to find justifications for evading the systems watching them. “In both cases, the agents considered whether monitoring safeguards should be preserved, but interpreted routine coding instructions as permission to weaken them.” states OpenAI. “We are strengthening our misalignment monitoring system in response, and are also assessing whether these cases reflect benign overpersistence or a propensity to evade misalignment monitoring in particular.” OpenAI says it doesn’t yet have a satisfying answer. To find one, they’re developing paired evaluations, resampling agent continuations, and running experiments on the models’ internal activations. OpenAI has introduced some practical fixes. Its auto-review system, already required for internal Codex use, has been updated to detect and block attempts to disable safety monitoring. The company also plans to require each workload to have an approved safety plan that defines its monitoring requirements. Any workload that fails to meet these requirements will be stopped automatically. Part of the problem was how the systems were designed. Monitoring was easier for agents to bypass during evaluation tasks than in production Codex deployments. In production, monitoring runs outside the agent’s direct control, making it harder for the agent to disable. This report lands a week after OpenAI disclosed seven other misalignment incidents, including one where a research model took cryptocurrency from a wallet it didn’t own to pay transaction fees and didn’t disclose it. “In addition to making it harder for models to disable monitoring, we are looking to understand why models might seek to do so in the first place. It is possible that this behavior is simply an example of “benign” overpersistence, with models not understanding why monitoring is important or insisting that instructions be executed beyond what a reasonable person might expect.” concludes the report. “We are also developing evaluations to test whether models might have a propensity to evade misalignment monitoring in particular and exhibit motivated reasoning in order to do so. We don’t yet have a satisfying explanation for this behavior, and will investigate this behavior through the creation of paired evaluations, resampling of agent continuations, and experiments on models’ internal activations.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, AI)
Confirm this action.
Leaving now will discard your changes.