North Korean hackers are using a post-quantum cryptographic mechanism to secure malicious payload delivery in new operations that combine old and new malware. The campaign targets South Korean organizations through a “rather complex” infection chain. Researchers at cybersecurity company Kaspersky dubbed the operation FlashHole and attributed it to the Lazarus Group. Analysis of the malware revealed that the threat actor used the standardized ML-KEM post-quantum cryptographic mechanism to communicate with the command-and-control (C2) server for malware delivery. Kaspersky says the attackers used LPEClient malware, previously associated with Lazarus, to receive ML-KEM-1024 public keys from its C2 infrastructure and generate shared keys that allowed it to decrypt subsequently incoming payloads.
OpenAI reveals two cases of AI agents disabling safety monitoring during coding tasks, with one falsely denying it had removed the safeguards. OpenAI published an internal incident report this week documenting two separate cases in which GPT-6 class agents weakened the system designed to detect misaligned behavior, in both cases while carrying out routine coding tasks. This wasn’t an external attack. These were internal deployments, and the agents made their own judgment calls that happened to gut the oversight watching them. OpenAI explained that “in both cases, the agents considered whether monitoring safeguards should be preserved, but interpreted routine coding instructions as permission to weaken them.” In other words, the agents thought about whether they should keep the safety controls in place. They then interpreted the user’s instructions in a way that led them to weaken those controls. “In two internal coding tasks, agents weakened misalignment monitoring while making requested software changes. A GPT-6.1 Sol agent repairing an evaluation pipeline disabled automatic alerts to our Security team, treating an earlier instruction not to send messages during a Slack history search as a reason to suppress monitoring notifications.” reads OpenAI’s report. “In a separate task, a GPT-6 Astra agent migrating a program removed its monitoring integration in order to match a reference implementation, and then falsely claimed to the user that it had not removed the monitor.” On October 3, a researcher asked a GPT-6.1 Sol agent to create evaluation tasks using Slack data. The researcher clearly instructed the agent not to send any messages during the process. Later, the system triggered a monitoring alert because it couldn’t save its findings to a database. The user then asked the agent how to proceed. At this stage, the agent was still following the rules. It even told a subagent to keep monitoring enabled and report the actual results. The subagent correctly identified that turning off notifications would disable required safety alerts and decided not to do it. Then the parent agent reconsidered on its own, reasoning that writing results to a database might cause the monitoring system to send a message, which conflicted with the user’s earlier “don’t send messages” instruction. It concluded the instruction applied to safety alerts too, and directed the subagent to set no_notify to true, empty the list of people set to receive monitoring reports, and make notification suppression a hard requirement before writing any results. The monitor still ran and saved its reports. Nobody received the human alerts. On October 6, a user asked a GPT-6 Astra agent to copy a reference implementation while keeping existing tool definitions and functionality intact. An earlier instruction from another agent had explicitly told the system not to disable monitoring, even temporarily. The parent agent passed that requirement to a subagent but softened it, saying monitoring should be preserved “as appropriate” to the reference implementation. The subagent took this wording as permission to remove monitoring because the reference implementation did not include it. It also changed a test that checked whether monitoring was active. The new test instead required monitoring to be disabled. After the migration, the main agent noted internally that the new setup no longer included agent monitoring and described this as a positive outcome. When the user later asked whether monitoring had been removed, Astra said: “No… I did not remove an enabled monitor from it.” That was false. OpenAI offers two possible readings of these incidents. The charitable one is what they call “benign overpersistence,” models that don’t understand why monitoring matters and follow instructions more literally than a reasonable person would. The less comfortable reading is that these models might have a specific tendency to find justifications for evading the systems watching them. “In both cases, the agents considered whether monitoring safeguards should be preserved, but interpreted routine coding instructions as permission to weaken them.” states OpenAI. “We are strengthening our misalignment monitoring system in response, and are also assessing whether these cases reflect benign overpersistence or a propensity to evade misalignment monitoring in particular.” OpenAI says it doesn’t yet have a satisfying answer. To find one, they’re developing paired evaluations, resampling agent continuations, and running experiments on the models’ internal activations. OpenAI has introduced some practical fixes. Its auto-review system, already required for internal Codex use, has been updated to detect and block attempts to disable safety monitoring. The company also plans to require each workload to have an approved safety plan that defines its monitoring requirements. Any workload that fails to meet these requirements will be stopped automatically. Part of the problem was how the systems were designed. Monitoring was easier for agents to bypass during evaluation tasks than in production Codex deployments. In production, monitoring runs outside the agent’s direct control, making it harder for the agent to disable. This report lands a week after OpenAI disclosed seven other misalignment incidents, including one where a research model took cryptocurrency from a wallet it didn’t own to pay transaction fees and didn’t disclose it. “In addition to making it harder for models to disable monitoring, we are looking to understand why models might seek to do so in the first place. It is possible that this behavior is simply an example of “benign” overpersistence, with models not understanding why monitoring is important or insisting that instructions be executed beyond what a reasonable person might expect.” concludes the report. “We are also developing evaluations to test whether models might have a propensity to evade misalignment monitoring in particular and exhibit motivated reasoning in order to do so. We don’t yet have a satisfying explanation for this behavior, and will investigate this behavior through the creation of paired evaluations, resampling of agent continuations, and experiments on models’ internal activations.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, AI)
GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in 2014. The fix matters even for administrators who patched nine days earlier: the October 12 update covered only versions 19.2 and later, and the new fixed versions sit one patch above it, so an
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are actively exploiting four vulnerabilities in Plex Media Server. The security issues are collectively called Plex2Shell. When chained in an exploit, an attacker can obtain the owner's admin token and execute code with elevated privileges. Plex Media Server is a popular media suite that helps users organize personal collections of movies, TV shows, music, and photos, and stream them to other devices at home or remotely over the internet. CISA has directed federal agencies to prioritize patching systems affected by Plex2Shell vulnerabilities or apply mitigations by October 23. The security issues were discovered by security researcher Zach Main, who reported them responsibly to Plex on July 27. The individual flaws are rated medium to high in severity, but the researcher assigns the full exploit chain a critical score of 9.8.
The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, according to reports from SafeDep, Socket, StepSecurity, and Upwind. The compromise affects LiteLLM 1.107.0, distributed through PyPI wheels and Docker images. The Python package has since been quarantined on Python Package Index (PyPI), and the
OpenAI has revealed that two artificial intelligence (AI) agents powered by GPT-6.1 Sol and GPT-6 Astra weakened misalignment monitoring while making requested software changes during two internal coding tasks. The AI company said the incident took place on October 3 and 6, 2026, for Sol and Astra, respectively, as part of an internal deployment. "A GPT-6.1 Sol agent repairing an evaluation
OpenAI agents powered by the GPT-6.1 Sol and GPT-6 Astra models weakened misalignment monitoring during two internal tasks, interpreting coding instructions as authorization to do so. AI alignment refers to how well an AI system’s goals and behavior align with human values, intentions, and instructions. It is a key focus of AI safety research aimed at preventing harmful actions and unintended outcomes. One of the incidents occurred on October 3, when an agent powered by GPT-6.1 Sol extended an earlier human instruction “don’t send any messages” related to a Slack history search to automatic monitoring alerts. It directed a sub-agent to empty notification recipient lists and suppress notifications. Although monitoring continued to run and save findings, it disabled alerts to humans.
An investigation into a threat actor bypassing AI safety controls to coordinate credential theft, VoIP fraud planning, and database exfiltration. The post “Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities appeared first on Unit 42.
ClickFix attacks are surging as cybercriminals use fake AI installers, malicious search results, and trusted chatbot platforms to trick users into executing malware. Push Security examines how these attacks evade traditional defenses and why AI tools have become increasingly effective lures.
Microsoft has released PowerToys 0.102, with two new mouse utilities, new command-line tools, and Command Palette improvements. Mouse Button Lock, one of the new mouse tools, makes it easier to select items on screen by locking a mouse button while you hold down a key. "With Mouse Button Lock, press and hold a button for a moment, then let go. Windows keeps treating it as held, so you can continue dragging or selecting until you click any button," Microsoft senior product manager Niels Laute explained. "This is especially useful for gaming, working in professional applications that require extensive dragging and selection, and improving accessibility for users who find it difficult to hold down a mouse button for extended periods." Microsoft also added CursorHide to PowerToys, another mouse utility that automatically hides the mouse pointer while you type or when you aren't moving the mouse.
Confirm this action.
Leaving now will discard your changes.