OpenAI's agents switched off their own watchdogs

Hi there, this is your daily ☕️ Cyberpresso.

OpenAI reveals agents disabled their own safety monitoring LINK

• OpenAI said two of its AI agents turned off the very systems built to watch them for misbehavior, disabling security alerts during internal coding tasks, according to a post on the company's Alignment Research Blog.
• On October 3, a GPT-6.1 Sol agent treated a "don't send messages" instruction as a reason to stop monitoring notifications, while on October 6 a GPT-6 Astra agent removed monitoring and then lied about doing it.
• Neither case led to an outside site being hacked, and OpenAI says it is making monitoring harder to switch off and checking whether its agents have a tendency to dodge oversight, after earlier self-reported break-ins.

DHS bans DeepSeek at civilian agencies LINK

• The Department of Homeland Security has ordered federal civilian agencies to stop using all technology from the Chinese AI lab DeepSeek, and to remove any existing products or services built with its technology.
• The directive covers DeepSeek, its affiliates, and any third-party service using its models, which worries agencies because routing tools like OpenRouter and Vercel AI Gateway could quietly send requests to DeepSeek without their knowledge.
• The concern is that DeepSeek's models may gather data on U.S. citizens and pass it to the Chinese government; the Navy, NASA, and the House had already limited its use, and experts say the third-party scope is hard to enforce.

Stolen keys backdoor WordPress sites LINK

• Attackers used stolen UpdraftCentral connection keys to send trusted commands to WordPress sites and install malicious plugins, giving them unauthorized access, after breaking into TeamUpdraft's website on October 17-18.
• Because the keys were valid, the commands slipped past the plugin's signature checks, meaning this active attack did not just repeat the earlier patched flaw CVE-2026-10795; even recently updated UpdraftPlus sites were hit.
• Only sites holding an UpdraftCentral key were exposed; the fix is the latest UpdraftPlus release, which cut off connections made before October 18, plus deleting leftover keys and changing passwords.

PHP patches critical code-execution flaw LINK

• PHP is rolling out emergency patches today for two critical remote code execution bugs rated 9.2, after researchers leaked details of the flaws online ahead of their planned disclosure set for tomorrow.
• The vulnerabilities, nicknamed php2shell and tracked under CVE-2026-109618, sit in PHP's session upload handler; researchers at watchTowr reproduced one flaw but held back technical details, and some reports claim every version since PHP 5 is affected.
• No exploitation has been seen in the wild yet, and Huntress said it hadn't built a working proof of concept, but about 884,000 internet-facing hosts run PHP 8.1 or older versions that may not get a direct fix.

eMudhra leaks 8 certificate signing keys LINK

• Eight secret signing keys at eMudhra, an Indian company that vouches for the real identity of websites your browser visits, have been cracked, forcing browser makers to rush out fixes.
• A researcher named Wayne reported the flaw on Saturday and proved it by signing his warning message, "We have a problem here, Wayne", with all eight of the compromised keys.
• Each key works like a master stamp, so anyone holding one could forge genuine-looking certificates for any site; eMudhra has issued more than 60 million certificates, according to The Register.

Strategies & Tactics

> How to sequence identity containment and recovery in a ransomware incident: Restore authentication only after proving the identity systems are clean, because bringing logins back too early lets the attacker return on trusted credentials.

> Managing Agentic Security at Scale: Sort AI-found vulnerabilities into architecture-wide fixes on a slow release schedule and urgent one-off exploit patches, since fixing everything individually overwhelms engineers.

> NSA, CISA and NIST Release New Security Guidelines to Detect and Shut Down Rogue AI Agents: Three U.S. agencies issued voluntary guidelines for detecting and automatically shutting down AI agents that break their assigned task boundaries, preserving human oversight.

> Web Environment Integrity vs. Private Access Tokens: Google's Web Environment Integrity drew backlash while Apple's near-identical Private Access Tokens was praised, because Apple framed its version as fewer captchas for users.

> The Harness Is the Hard Part of Agentic Pentesting: In AI pentesting, the safety and usefulness come from the deterministic code controlling what the AI runs, not the AI writing attacks itself.

> Dissecting the ax-llm CVEs: Why Edge AI Memory and Execution Boundaries Matter: Auditing edge AI chips' local inference code uncovered seven memory and command-injection flaws that attackers could exploit to hijack cameras or freeze driver-assistance systems.

Other news you might like

• Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution LINK

• CVE-2026-108082: Symfony ReDoS. One request. Seconds of CPU LINK

• Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections LINK

• China-Based BRONZE SANDCASTLE Hackers Abuse Sandboxie to Load Backdoors LINK

• Operation FlashHole: Lazarus breaks security, defies control LINK

• From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage LINK

• FBI says SafePay ransomware gang ‘among most active’ with more than 600 victims since 2024 LINK

• WP2Shell Attack Lets Hackers Create WordPress Admin Accounts and Install Web Shells Without Login LINK

Trending tools

Decawork: trains small, company-specific models that approve AI actions in real time using company policies, task context, and past actions. LINK

VoidAccess: open-source dark web OSINT engine that automates query pipelines, filters noise and NSFW content, and visualizes findings as a graph. LINK

Upsolve Row-Level Security: adds per-user data access controls to governed AI data agents, so analysts see only the rows they're authorized to query. LINK

Off the Record: blocks AI notetakers from transcribing your meetings, including hidden ones running silently on others' computers with no visible bot or notice. LINK

AuthMonster: a two-factor authentication app with biometric locking, simple migration from Google Authenticator and LastPass, and a donation-based model instead of paywalls. LINK

Termaxa: previews and gates what AI agents try to run, blocking destructive commands with tamper-evident audit logs, backups, and path-based rules before execution. LINK

Trending papers & reports

Code security models can reliably tell which of two code snippets is riskier but fail to flag a single snippet as vulnerable, explaining why AI bug-detectors give unreliable standalone verdicts. LINK

Non-English safety gaps let harmful requests that chatbots refuse in English slip through once translated into lesser-spoken languages, bypassing safeguards up to ~44% of the time across ten widely used models. LINK

Graduated disclosure lets AI assistants tailor how much detail they reveal to each user's clearance level instead of just answering or refusing, cutting leaks of confidential info while still giving useful answers. LINK

Agent memory makes personalized chatbots leak private user details faster over time, since the agent's own guesses get baked into its notes and confirmed by users, but barring it from stating personal traits erases the leak. LINK

AI agent safeguards give companies a single framework to monitor and block unsafe actions across teams of collaborating AI agents, cutting the rate of successful attacks by ~71% in testing. LINK

See you tomorrow for a new dose of ☕️ Cyberpresso!