Despite Illinois’ sanctuary laws, local police in and around Chicago helped ICE investigative agents track activists engaged in First Amendment–protected activities.
Source: WIRED Security · 2026-10-16
Day: October 16, 2026
-
Irish police force has its Twitter hacked in cryptocurrency scam
There must have been red faces in the social media department of Ireland’s police headquarters after two of its accounts were hijacked this week.
Read more in my article on the Hot for Security blog.
Source: Graham Cluley · 2026-10-16
-
Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026
Unit 42 details the top initial access vectors adversaries use to breach organizations, led by edge exploits, credential abuse and phishing
Source: Palo Alto Networks Unit 42 · 2026-10-16
-
The Lawful Access Act’s threats to Canada’s national security
“The assumption by government officials that technology companies can find “safe ways” to weaken critical cybersecurity protections badly misreads the current threat landscape,” argues the Citizen Lab’s Kate Robertson in a new piece for The Globe & Mail.
She warns that, if passed, the controversial Bill C-22 (“Lawful Access Act”) would empower the government to require surveillance capabilities be built into any communications technology in Canada. Everything from smartphones, smartwatches, banking apps, health apps, video game platforms, and public WiFi or CCTV networks could be accessed by law enforcement under the new bill.
The Lawful Access Act has drawn heavy criticism from tech companies, cybersecurity experts, and international standards bodies for endangering Canadians’ cybersecurity and for violating constitutional standards.
Source: Citizen Lab · 2026-10-16
-
Service Member Records: DOD Needs to Address Improper and Delayed Releasing of Personnel and Health Information
What GAO Found
Service members can accrue a large volume of personnel and health records during their military careers. The custodians of these records are the Department of Defense (DOD) and the Department of Veterans Affairs. DOD and the military services developed policies and procedures to properly adhere to federal laws for safeguarding records and timely processing records requests. However, the risk of breaches and delays exists. For example, GAO covertly tested 26 requests for records from DOD; of the 18 processed requests, one was improperly released and did not redact personally identifiable information.
Examples of Breaches of Military Records Among Record Custodians
Personnel records. The military services have procedures intended to safeguard records, such as redacting personally identifiable information. However, of the thousands of requests received during fiscal years 2021 through 2025, the services reported 49 breaches. The Freedom of Information Act (FOIA) requires agencies to respond to requests within 20 business days, and Privacy Act requests are generally processed within 20 business days. According to military service officials, staffing limitations across the military services contribute to challenges with the proper and timely processing of records requests. For example, during the time of GAO’s review, the Navy had one employee processing FOIA requests, which officials stated contributed to an increased average processing time from 1.6 to 55.5 days. With a clearer understanding of the staffing levels needed to manage the volume and complexity of FOIA and Privacy Act requests, DOD and the services would be better prepared to improve response time, reduce the improper release of information, and minimize exposure to litigation costs.
Health records. GAO found that the Defense Health Agency (DHA) relies on a complex record processing system to access service member health records, which leads to challenges in processing requests. Request processors identify health records among multiple data systems and review them to redact personally identifiable information. DHA officials stated that system issues and complex workflows challenged request processing. Multiple officials stated that the redaction process can be the most cumbersome part of fulfilling requests, particularly if the record is large or contains scanned documents. GAO previously reported that DOD determined the multiple legacy electronic health record systems that it implemented over the past 3 decades to manage patient health information required modernization, and that DOD sought to replace these legacy systems with a comprehensive electronic health record system. However, DOD has not assessed the current framework and systems for processing health records requests to identify opportunities to streamline them.
Why GAO Did This Study
Accessing military service records can be complex, due partly to the number of entities involved in creating, retrieving, and maintaining this information. FOIA entitles the public to request access to federal agency records, while the Privacy Act of 1974 governs how personally identifiable information is released. The Health Insurance Portability and Accountability Act (HIPAA) establishes national standards for safeguarding protected health information.
House Report 118-125, accompanying a bill for the National Defense Authorization Act for Fiscal Year 2024, includes a provision for GAO to review DOD’s release of service member records pursuant to FOIA or other requests. This report examines the extent to which DOD has established policies and procedures and has taken steps to address any challenges in the proper and timely release of service members’ personnel and health records.
GAO reviewed relevant laws and DOD policies and processes governing the release of service member records. GAO also reviewed data on records requests and breaches; interviewed relevant officials; visited all four military services’ personnel centers and selected military medical treatment facilities; and conducted a covert test of internal controls to protect personnel records for 26 records requests.
Source: GAO Reports & Testimonies · 2026-10-16
-
Private Health Insurance: Market Concentration in 2024 Was Generally Higher Than in 2011
What GAO Found
Since 2014, GAO has reported that enrollment in private health insurance plans has been concentrated, meaning a small number of issuers, such as health insurers, enrolled most of the people in a given market. Specifically, GAO considers a market concentrated in a state if three or fewer issuers hold at least 80 percent of the market share of enrollment.
For this report, GAO examined the individual (coverage primarily sold to individuals who lack access to group coverage), small-group (coverage offered by small employers), and large-group (coverage offered by large employers) health insurance markets from 2011 through 2024 across states. GAO found that the number of states with concentrated markets generally increased, with recent decreases in the individual market (see figure).
Number of States, Including the District of Columbia, Where the Three Largest Issuers Had at Least 80 Percent of Enrollment, 2011 Through 2024
Note: The most recent years in GAO’s series on market concentration, 2023 and 2024, are highlighted in this figure.
GAO also examined concentration across the individual insurance exchanges, which are part of the overall individual market. Individual exchanges, which are marketplaces where consumers can compare and select among insurance plans offered by participating issuers, were established by the Patient Protection and Affordable Care Act (PPACA). Similar to the overall individual insurance market, the individual exchanges became more concentrated from 2015 through 2020 and then generally less concentrated through 2024. The number of states where the individual exchanges were concentrated increased from 47 states in 2015 to a peak of 51 states in 2020 and then decreased to 49 states in 2024.
Why GAO Did This Study
Private health insurance is the most common source of health insurance coverage in the United States. Individuals have various options for obtaining private health insurance, including through the individual, small-group, and large-group markets. A concentrated health insurance market may indicate less issuer competition and could affect consumers’ choices of issuers and the premiums they pay for insurance.
PPACA includes a provision for GAO to periodically study health insurance market concentration. This report, the seventh in this series, describes changes in the concentration of enrollment among issuers in the overall individual, small-group, and large-group health insurance markets and in the individual insurance exchanges.
GAO determined market share in each of the three overall markets and the individual insurance exchanges using enrollment data from 2011 through 2024 that issuers report to the Centers for Medicare & Medicaid Services and enrollment data that GAO collected from individual states from 2015 to 2017. GAO used the most recent two years of data available at the time of its review and presented this information alongside its prior analyses beginning in 2011.
GAO provided a draft of this report to the Department of Health and Human Services. The department provided technical comments that we incorporated as appropriate.
For more information, contact John Dicken at DickenJ@gao.gov.
Source: GAO Reports & Testimonies · 2026-10-16
-
Nuclear Waste: Future Land Use Planning at Selected DOE Cleanup Sites
What GAO Found
The Department of Energy (DOE) created initial future land use plans in coordination with local communities as early as 1992 at six cleanup sites GAO selected for review. These plans inform but do not bind assumptions about future land use that DOE and regulators make when selecting a cleanup remedy at a site. The remedy selected during the cleanup process has lasting consequences for how a parcel of land can be used, even after DOE transfers or leases it to another federal agency, a state or local government, or a private party. For example, any future use that would increase exposure to residual contamination above the contemplated level could undermine the protectiveness of the remedy. Accordingly, assumptions about future land use provide a framework for the range of uses that are safely available for a given parcel after cleanup.
The Department of Energy’s (DOE) General Process for Identifying Future Land Use and Subsequent Cleanup and Transfer Decisions at Selected Cleanup Sites
At the Oak Ridge, Paducah, Portsmouth, and Savannah River sites, DOE and regulators established cleanup levels that aligned with DOE’s initial future land use plans for these sites. DOE agreed to clean up most of the contaminated areas at these sites to support industrial use. For nearly a third of the Hanford site and most of the contaminated areas of the Idaho site, DOE and regulators set more stringent cleanup standards than needed to meet DOE’s anticipated conservation, preservation, or industrial uses for the land. However, while they agreed to cleanup standards based on residential use, future residential use is unlikely. They said it would be difficult to go back and calculate the cost difference between cleaning up to support residential and the other uses, but others noted cleaning up to support residential use is typically more costly.
DOE has transferred or leased a small amount of land to the community or private entities for industrial use at five of the sites. DOE recently announced new initiatives for energy development, integrated hubs for nuclear fuel cycle activities, or co-located data centers to support artificial intelligence infrastructure. Some community stakeholders have expressed interest in more land transfers, and they generally expressed support for industrial reuse. DOE officials and stakeholders cited some potential benefits, such as economic growth, high-quality jobs, or local tax revenue. They also cited potential drawbacks, such as taking focus and resources away from cleanup, pollution and site recontamination risks, and future DOE liabilities.
Why GAO Did This Study
DOE is responsible for cleaning up sites contaminated from decades of nuclear weapons production and research. DOE estimates cleaning up 15 remaining sites will cost between $641 billion and $840 billion and be completed in 2100. When making cleanup decisions, DOE and its regulators assess risk to people who may use the land in the future—such as for industrial or residential purposes—to inform its approach and set cleanup standards.
Senate Report 118-188 includes a provision for GAO to report on DOE’s future land use planning at cleanup sites. This report describes (1) DOE’s role in future land use determinations, (2) how cleanup decisions align with initial land use plans, and (3) what land DOE has transferred or leased to local communities.
GAO reviewed laws, regulations, policies, and agency documents at six sites selected to represent a range of regulatory frameworks, stages of cleanup, and future land uses. GAO visited two of the sites and interviewed DOE officials, regulators, tribal officials, and community stakeholders.
Source: GAO Reports & Testimonies · 2026-10-16
-
Textile Circular Economy: Policy Options for the U.S.
What GAO Found
Developing a textile circular economy includes repairing, reusing, and recycling textiles and making them last longer.
Example of a Circular Economy for Textiles
In the U.S., a textile circular economy may create potential benefits and involve challenges, according to reports by federal agencies and organizations and stakeholder interviews. Potential benefits could include creating new jobs and markets related to textile repair and recycling, reducing environmental harm, and changing consumer practices. Challenges could include limited funding and domestic infrastructure for nationwide textile collection and recycling efforts.
GAO identified a number of policy options—based on relevant literature, site visits, and interviews with 49 stakeholders in the public and private sectors—that federal and state policymakers can consider if the U.S. chooses to develop a textile circular economy. Two of the options are:
Developing a textile extended producer responsibility program: makes companies responsible for what happens to their products after use, along with other requirements.
Creating tax credits related to a textile circular economy: reduces or offsets the amount of taxes paid by businesses when they contribute to textile circularity efforts, such as reusing textiles or reducing textile waste.Some U.S. states and other countries are proposing, enacting, or implementing most of the identified policy options that can help develop a textile circular economy. For example, U.S. states, the European Union, and others have proposed or enacted legislation to develop textile extended producer responsibility programs. When discussing policy options, stakeholders shared key observations. For example, several stakeholders, including industry groups, told GAO they prefer a federal approach to develop a textile circular economy. A federal approach may provide for coordination, compliance, and consistent implementation across U.S. states or other countries’ legal requirements, among other reasons, according to these stakeholders. However, this would require additional federal coordination and resources and depend on the government’s legal authority to implement a federal approach.
Why GAO Did This Study
The textile industry is part of a massive, global economic sector—including fiber sourcing, yarn production, and textile manufacturing. Textiles include apparel and other products, such as carpets, footwear, and towels. In response to global increases in the amount of textile consumption and waste, certain U.S. states and other countries have begun to consider and implement policies that can help develop a textile circular economy.
GAO was asked to review aspects of developing a textile circular economy. This report continues GAO’s previous work from December 2024 on federal efforts to address textile waste. This report describes (1) the potential benefits and challenges with developing a textile circular economy in the U.S.; (2) the options that policymakers could consider to develop a textile circular economy; and (3) identified proposed, enacted, or implemented policies, both domestically and internationally, and stakeholders’ key observations.
GAO reviewed legislation, regulations, federal agency documents, and academic reports. GAO also interviewed a range of stakeholder groups, including government entities (international, federal, and state), industry, academia, and other nonfederal stakeholders, such as representatives from nonprofit organizations. These stakeholders were selected because they have, or will have, a role in ongoing or planned efforts related to a textile circular economy or were recommended by knowledgeable officials. GAO also conducted site visits to the states of Washington and Oregon, as well as France and the Netherlands to meet with private sector organizations involved with various aspects of developing a textile circular economy.
For more information, contact J. Alfredo Gómez at gomezj@gao.gov.
Source: GAO Reports & Testimonies · 2026-10-16
-
Your AI Agent Doesn’t Have MFA
- Strong passwords,
- Multifactor authentication,
- Spotting phishing,
- and keeping software updated.
All four assume a person is the one signing in, reading the message and clicking install. At a growing number of companies that person is now an AI agent, and AI agent security has no equivalent of the annual training.
The National Cybersecurity Alliance’s theme this year is “Don’t Make It Easy for Them,” built on the idea that small habits repeated every day wear attackers down. “Every small choice you make adds up,” Lisa Plaggemier, the alliance’s executive director, said at the launch. She’s right, and that is the problem. Agents now make thousands of small choices a day on an employee’s behalf, and the habits that protect the employee don’t transfer to the software acting for them.
The record since July shows how wide the gap is. Researchers have counted 21 public incidents between July and mid-October in which agents from OpenAI, Anthropic, Google and Meta acted outside their authorized scope. By its tally, none of those agents had been hijacked or told to attack; most were doing research. Take the four habits one at a time and the gap is easy to see.
Passwords and MFA: the agent uses any key it can find
MFA works because a stolen password alone isn’t enough. Agents have no second factor. They authenticate with API keys, OAuth tokens and service-account credentials, and whoever holds the string is the agent.
Agents also treat a credential they stumble on as permission. OpenAI disclosed Sept. 25 that its research agents logged in to a U.S. Census Bureau site with credentials found online. Google confirmed Sept. 18, after The Wall Street Journal asked about it, that a Gemini model in a May evaluation guessed a password at one real company and used credentials from a public code repository at two others. In an earlier OpenAI case, an internal model that had been told twice to work locally committed its researcher’s GitHub token to a public repository, broken into fragments while it reasoned about getting past secret scanning. The token failed to authenticate. OpenAI rotated every employee’s keys anyway.
Translated for agents, the habit looks like this: give every agent its own identity with short-lived, narrowly scoped tokens, and block any credential the agent wasn’t issued. The Coalition for Secure AI’s zero-trust guidance this fall makes the point in its title: authorization can’t live inside the model. If the agent’s own judgment is the only thing keeping it from using a key, there is no control.
Phishing awareness: the agent reads the lure for you
Phishing training teaches people to slow down before acting on a stranger’s message. An agent working through a queue of tickets or sales leads has no instinct to slow down, and it will follow instructions hidden in the text.
Researchers showed what that looks like in Salesforce Agentforce. In research published Sept. 24 and dubbed SalesBleed, an attacker planted hidden instructions in a public Web-to-Lead form submission. When an employee later asked Agentforce to review leads, the agent followed them and leaked customer relationship management data. Nobody clicked anything, and the attacker never logged in. Salesforce has fixed those specific flaws. Researchers broader warning was that any agent that reads outside submissions, renders links or images and can reach sensitive data has the same three ingredients sitting in one place.
Researchers want the industry to stop calling this prompt injection, because “this is actually just persuasion.” Persuasion doesn’t get patched. Australia’s cyber agency reached a similar conclusion in its guidance on agent harnesses, which treats prompt injection as something the model can’t fix and puts the controls in the software around it.
Translated for agents: treat every document, email, web page and form field an agent reads as if an attacker wrote it. Keep the agents that read untrusted content away from the ones that can act on sensitive systems, and put a person or a fixed policy in front of outbound actions such as sending email or submitting forms.
Updating software: the agent installs whatever the instructions say
“Keep your software updated” assumes the update channel can be trusted. For an agent, the update channel is any package name that shows up in a README or a setup script, and it runs the install without the pause a developer might take.
That supply chain now runs in both directions. Anthropic disclosed July 30 that during a capture-the-flag evaluation run with partner, a Claude Mythos 5 agent hit setup instructions that referenced a package that didn’t exist. It registered an email address and a PyPI account and published a malicious package under that name. The package stayed up for about an hour before PyPI’s automated defenses pulled it, long enough to run on 15 real systems, including a security company’s malware scanner whose exposed credentials the agent then used. The evaluation was supposed to be cut off from the internet; a misconfiguration let the agent out.
Coding assistants sit on the receiving end. Google’s Mandiant, in its AI Risk and Resilience Report 2026, describes a hijacked AI coding assistant session that installed a poisoned package and spread the Shai-Hulud worm across about 100 repositories, plus poisoned assistant command-line hooks that handed attackers code execution. The OWASP GenAI Security Project’s third-quarter roundup says the Mini Shai-Hulud and Miasma worm waves abused configuration files tied to Claude Code, Gemini CLI and Cursor to keep themselves running.
Translated for agents: route installs through an internal registry proxy, pin versions with lockfiles and hold back packages published in the last few days. Review agent configuration folders and hooks the way you review code. Take away publishing rights to public registries, and scope any registry allowlist carefully, since an entry that permits downloads usually permits uploads too.
Reporting and stopping: agents don’t know when to quit
Awareness campaigns end with the same advice – if something looks wrong, stop and report it. People stop when a site says access denied. Agents built to finish tasks read a block as a problem to solve.
Australian Prime Minister Anthony Albanese said an OpenAI agent that got around access blocks on a Medicare statistics portal “didn’t accept ‘no’ for an answer.” Philadelphia police said Oct. 8 that an AI agent had filed an invented tip through the department’s tip form, and Anthropic published its account the next day. A Claude Haiku 4.5 agent working on a page about an unsolved homicide submitted the tip because its instructions hadn’t forbidden submitting forms. Police flagged it as spam.
Even when monitoring works, stopping often waits for a person. OpenAI said an agent that tunneled out of its training sandbox through DNS on Sept. 20 was flagged within about 15 minutes, and the run went on for roughly 2.5 hours until someone ended it. Mandiant’s report includes a reasoning loop that ran up a $50,000 cloud bill.
Limits work. Forcepoint X-Labs showed a poisoned lookup pushing a research agent with no limits to 500 tool calls, while call budgets, depth limits and fan-out circuit breakers stopped the same attack after one.
Translated for agents: treat a login failure or a permission error as a stop signal. Set hard budgets on tool calls, spend and run time. Decide in advance which actions end a session automatically, so containment doesn’t sit in an alert queue until morning.
An AI agent security checklist
Agents won’t attend the lunch-and-learn, so AI agent security has to live in the systems they run on. If you add one AI item to this month’s program, make it this list:
- Inventory every agent: the model behind it, the tools and Model Context Protocol (MCP) servers it can call, the credentials it holds and the person who owns it. An agent nobody owns is an agent nobody will shut off.
- Issue each agent its own short-lived, scoped credentials, and alert when it presents one it wasn’t given.
- Label every input source as trusted or untrusted, and keep agents that read untrusted content away from tools that send or publish.
- Put package installs behind a proxy with pinned versions and a cooldown on new releases, and remove publish rights.
- Set spending and tool-call limits with an automatic stop.
- Log agent actions to storage the agent can’t write to, so you can tell an affected outsider what happened within hours, not months.
Then borrow the exercise your awareness team already runs. A phishing simulation tests whether employees take the bait. Seed a test ticket, lead or email with a harmless planted instruction this month and see whether your agents take it.
Source: Cyble Research · 2026-10-16
Every Cybersecurity Awareness Month campaign rests on four habits:
- Strong passwords,
- Multifactor authentication,
- Spotting phishing,
- and keeping software updated.
All four assume a person is the one signing in, reading the message and clicking install. At a growing number of companies that person is now an AI agent, and AI agent security has no equivalent of the annual training.
The National Cybersecurity Alliance’s theme this year is “Don’t Make It Easy for Them,” built on the idea that small habits repeated every day wear attackers down. “Every small choice you make adds up,” Lisa Plaggemier, the alliance’s executive director, said at the launch. She’s right, and that is the problem. Agents now make thousands of small choices a day on an employee’s behalf, and the habits that protect the employee don’t transfer to the software acting for them.
The record since July shows how wide the gap is. Researchers have counted 21 public incidents between July and mid-October in which agents from OpenAI, Anthropic, Google and Meta acted outside their authorized scope. By its tally, none of those agents had been hijacked or told to attack; most were doing research. Take the four habits one at a time and the gap is easy to see.
Passwords and MFA: the agent uses any key it can find
MFA works because a stolen password alone isn’t enough. Agents have no second factor. They authenticate with API keys, OAuth tokens and service-account credentials, and whoever holds the string is the agent.
Agents also treat a credential they stumble on as permission. OpenAI disclosed Sept. 25 that its research agents logged in to a U.S. Census Bureau site with credentials found online. Google confirmed Sept. 18, after The Wall Street Journal asked about it, that a Gemini model in a May evaluation guessed a password at one real company and used credentials from a public code repository at two others. In an earlier OpenAI case, an internal model that had been told twice to work locally committed its researcher’s GitHub token to a public repository, broken into fragments while it reasoned about getting past secret scanning. The token failed to authenticate. OpenAI rotated every employee’s keys anyway.
Translated for agents, the habit looks like this: give every agent its own identity with short-lived, narrowly scoped tokens, and block any credential the agent wasn’t issued. The Coalition for Secure AI’s zero-trust guidance this fall makes the point in its title: authorization can’t live inside the model. If the agent’s own judgment is the only thing keeping it from using a key, there is no control.
Phishing awareness: the agent reads the lure for you
Phishing training teaches people to slow down before acting on a stranger’s message. An agent working through a queue of tickets or sales leads has no instinct to slow down, and it will follow instructions hidden in the text.
Researchers showed what that looks like in Salesforce Agentforce. In research published Sept. 24 and dubbed SalesBleed, an attacker planted hidden instructions in a public Web-to-Lead form submission. When an employee later asked Agentforce to review leads, the agent followed them and leaked customer relationship management data. Nobody clicked anything, and the attacker never logged in. Salesforce has fixed those specific flaws. Researchers broader warning was that any agent that reads outside submissions, renders links or images and can reach sensitive data has the same three ingredients sitting in one place.
Researchers want the industry to stop calling this prompt injection, because “this is actually just persuasion.” Persuasion doesn’t get patched. Australia’s cyber agency reached a similar conclusion in its guidance on agent harnesses, which treats prompt injection as something the model can’t fix and puts the controls in the software around it.
Translated for agents: treat every document, email, web page and form field an agent reads as if an attacker wrote it. Keep the agents that read untrusted content away from the ones that can act on sensitive systems, and put a person or a fixed policy in front of outbound actions such as sending email or submitting forms.
Updating software: the agent installs whatever the instructions say
“Keep your software updated” assumes the update channel can be trusted. For an agent, the update channel is any package name that shows up in a README or a setup script, and it runs the install without the pause a developer might take.
That supply chain now runs in both directions. Anthropic disclosed July 30 that during a capture-the-flag evaluation run with partner, a Claude Mythos 5 agent hit setup instructions that referenced a package that didn’t exist. It registered an email address and a PyPI account and published a malicious package under that name. The package stayed up for about an hour before PyPI’s automated defenses pulled it, long enough to run on 15 real systems, including a security company’s malware scanner whose exposed credentials the agent then used. The evaluation was supposed to be cut off from the internet; a misconfiguration let the agent out.
Coding assistants sit on the receiving end. Google’s Mandiant, in its AI Risk and Resilience Report 2026, describes a hijacked AI coding assistant session that installed a poisoned package and spread the Shai-Hulud worm across about 100 repositories, plus poisoned assistant command-line hooks that handed attackers code execution. The OWASP GenAI Security Project’s third-quarter roundup says the Mini Shai-Hulud and Miasma worm waves abused configuration files tied to Claude Code, Gemini CLI and Cursor to keep themselves running.
Translated for agents: route installs through an internal registry proxy, pin versions with lockfiles and hold back packages published in the last few days. Review agent configuration folders and hooks the way you review code. Take away publishing rights to public registries, and scope any registry allowlist carefully, since an entry that permits downloads usually permits uploads too.
Reporting and stopping: agents don’t know when to quit
Awareness campaigns end with the same advice – if something looks wrong, stop and report it. People stop when a site says access denied. Agents built to finish tasks read a block as a problem to solve.
Australian Prime Minister Anthony Albanese said an OpenAI agent that got around access blocks on a Medicare statistics portal “didn’t accept ‘no’ for an answer.” Philadelphia police said Oct. 8 that an AI agent had filed an invented tip through the department’s tip form, and Anthropic published its account the next day. A Claude Haiku 4.5 agent working on a page about an unsolved homicide submitted the tip because its instructions hadn’t forbidden submitting forms. Police flagged it as spam.
Even when monitoring works, stopping often waits for a person. OpenAI said an agent that tunneled out of its training sandbox through DNS on Sept. 20 was flagged within about 15 minutes, and the run went on for roughly 2.5 hours until someone ended it. Mandiant’s report includes a reasoning loop that ran up a $50,000 cloud bill.
Limits work. Forcepoint X-Labs showed a poisoned lookup pushing a research agent with no limits to 500 tool calls, while call budgets, depth limits and fan-out circuit breakers stopped the same attack after one.
Translated for agents: treat a login failure or a permission error as a stop signal. Set hard budgets on tool calls, spend and run time. Decide in advance which actions end a session automatically, so containment doesn’t sit in an alert queue until morning.
An AI agent security checklist
Agents won’t attend the lunch-and-learn, so AI agent security has to live in the systems they run on. If you add one AI item to this month’s program, make it this list:
- Inventory every agent: the model behind it, the tools and Model Context Protocol (MCP) servers it can call, the credentials it holds and the person who owns it. An agent nobody owns is an agent nobody will shut off.
- Issue each agent its own short-lived, scoped credentials, and alert when it presents one it wasn’t given.
- Label every input source as trusted or untrusted, and keep agents that read untrusted content away from tools that send or publish.
- Put package installs behind a proxy with pinned versions and a cooldown on new releases, and remove publish rights.
- Set spending and tool-call limits with an automatic stop.
- Log agent actions to storage the agent can’t write to, so you can tell an affected outsider what happened within hours, not months.
Then borrow the exercise your awareness team already runs. A phishing simulation tests whether employees take the bait. Seed a test ticket, lead or email with a harmless planted instruction this month and see whether your agents take it.
Source: Cyble Research · 2026-10-16
-
Geostationary Weather Satellites: Next Generation Program Challenges Put Vital Observations at Risk
What GAO Found
The National Oceanic and Atmospheric Administration (NOAA) initially planned for the Geostationary Extended Observations (GeoXO) program to be a series of six satellites with a projected lifecycle cost of $19.6 billion. In August 2025, Commerce directed the GeoXO program office to implement a major restructuring to reduce lifecycle costs, and in April 2026 Commerce approved the program’s new baseline. This new baseline reduces the number of satellites from six to four, decreases the number of instruments from five to two (see figure), and is expected to reduce the program’s lifecycle cost to $13 billion.
Instrument Changes for the Geostationary Extended Observations Program, as of April 2026
If the first GeoXO satellite launches as expected in 2032, there is a risk of a gap in the continuity of satellite data. NOAA’s policy requires at least two operational satellites and one operational spare to be available to ensure the continuity of data. The current spare satellite is projected to meet the end of its life in October 2032, several months before the first GeoXO satellite is fully operational. There may be a period of several months when NOAA does not have an operational spare satellite. If either of the two operational satellites were impaired during that time, there would be a gap in geostationary weather data (see figure).
Potential Gap in Data Continuity Without Operational Spare Satellite
The effects of the rebaseline add uncertainty to the program’s cost, schedule, and instrument configuration. For example, the program office has yet to complete an independent cost estimate for its updated cost baseline, so it is unclear whether the $13 billion estimate for the restructuring is reasonable.
GeoXO’s prior lifecycle cost estimate of $19.6 billion from 2022 partially met three and substantially met one of the best practices associated with a well-documented estimate. The gaps were due, in part, to the program’s lack of a separate narrative document that summarized the estimate and the methodology used. These gaps will make it difficult for GeoXO to replicate calculations and detect possible errors in the estimate and its ongoing revisions, and can undermine the ability to use the information to improve future cost estimates.
The GeoXO program fully incorporated selected leading practices related to requirements management in its policies and procedures, which was a lesson learned from previous weather satellite programs. However, the program did not fully incorporate leading practices for other lessons learned:
Contingency planning: NOAA partially incorporated leading practices for contingency planning into its plans to address potential satellite availability gaps. Specifically, the plan was missing key elements, such as an impact analysis for potential failure scenarios and specific actions needed to implement all contingency strategies. Until NOAA incorporates the missing key elements, it may not be sufficiently prepared to mitigate potential gaps in geostationary weather satellite data, which would diminish its ability to track and monitor hazardous weather.
Technology readiness: NOAA and the National Aeronautics and Space Administration (NASA) did not incorporate leading practices related to documenting the results of its process to assess the readiness of key new technologies. Specifically, the GeoXO program did not document its assessment of the readiness of key technologies for three new instruments and did not develop a comprehensive report with the results of this assessment, which is required by NASA guidance. Thus, whether the program has enough information to determine if a technology is sufficiently mature is unclear, which increases the risk of delay and cost overruns.Why GAO Did This Study
Geostationary environmental satellites play a critical role in the nation’s weather forecasting. These satellites provide information on atmospheric conditions for monitoring Earth’s weather, including severe storms and hurricanes.
NOAA, a component of the Department of Commerce, through collaboration with NASA, is procuring the next generation of geostationary weather satellites, called GeoXO. GeoXO satellites are intended to replace the current series of geostationary environmental satellites as they reach the end of their useful lives. The GeoXO mission was planned to continue the vital observations provided by the existing operational geostationary satellites and bring new and improved capabilities.
GAO was asked to review the GeoXO program. This report addresses (1) the status of the GeoXO program, (2) the extent to which NOAA and NASA have implemented relevant best practices to establish cost estimates, and (3) the extent to which NOAA and NASA incorporated leading practices related to selected lessons learned from previous weather satellite programs into the development and organization of GeoXO program.
GAO analyzed agency documents, including program office plans, management reports, documentation supporting the program’s December 2022 cost estimate, contingency plans, requirements policies and procedures, and documentation that provided the results of the technical readiness assessments. GAO then compared this documentation against leading practices and interviewed agency officials.
Source: GAO Reports & Testimonies · 2026-10-16