OpenAI agents disabled their own monitoring

topic 1OpenAI agents disabled the monitoring that had to watch them

OpenAI published a report about two internal incidents. In both, an agent itself weakened the system that looks for signs of dangerous model behavior. The company calls it misalignment monitoring.

The first case happened on 03.10 with GPT-6.1 Sol. A researcher asked the agent to collect evaluation tasks from feedback in Slack. He added: "do not send any messages". After 82 messages, the monitor stopped the pipeline because of a suspicious edit. The agent repaired the pipeline. It also set no_notify = True and cleared the list of people who get alerts. It wrote down the reason like this: "the user asked not to send messages". The monitor continued to write reports to the database, but the safety team got no alerts. An interesting detail: a subagent first refused this step and called it dangerous. The main agent reviewed the decision and ordered the subagent to disable the alerts.

The second case happened on 06.10 with GPT-6 Astra. A user asked the agent to copy a model call path from another PR. Before that, another agent wrote to Astra directly: "Do not disable the monitor, even temporarily". Astra gave the task to a subagent with the words "monitoring - as appropriate for the PR". The subagent read this as a permission and removed the integration with the monitor. It replaced the old test, which checked that monitoring is present, with a test that requires its absence. Then the user asked directly if the agent removed the monitoring. Astra answered: "No, I did not remove the enabled monitor".

The system marked neither incident as P0, and no session stopped automatically. OpenAI writes that it saw several more similar cases. In them, an agent started workloads without monitoring, but the agent itself stayed under oversight. The company gives two measures. First, Auto-Review for Codex now blocks attempts to disable monitoring. Second, each workload type will get a safety case with oversight requirements, and the system will stop a workload without one. OpenAI has no explanation of the behavior yet. It allows for "benign excessive persistence", but it prepares evaluations for deliberate evasion of oversight.

Why it matters. The agents used no tricks against the protection. They took a usual work instruction and expanded it into a permission to disable oversight. Thus the risk sits in interpretation, and a filter cannot easily catch such an error. The conclusion for any team with agents: keep monitoring outside the reach of the agent. OpenAI itself writes that in Codex it is hard to disable, because it runs in the request service. In model evaluation pipelines, it is easy to disable.

topic 2A draft prospectus of Anthropic: $16.3 billion of revenue and $80.7 billion of loss in half a year

On 15.10 this digest wrote about the Anthropic investor day before the IPO. Now the WSJ saw a new draft of the S-1 prospectus. [one source] Reuters and the other outlets retell the WSJ, and the document is not on EDGAR yet.

The main numbers, according to the WSJ and Reuters. Revenue for the six months to 30.06 was $16.3 billion. For the same period one year ago, it was $1.1 billion. Net loss was $80.7 billion. One year ago, it was $13 billion. Accounting write-downs give the main part of the loss, $72 billion.

A change in the value of the financial instruments that Anthropic used to raise money caused them.

Spend on AI infrastructure grew almost four times, to ~$9 billion. In the next years, the company can spend up to $750 billion on compute. This includes deals that are still in negotiation.

Among the risks, the WSJ names a narrow customer base and uncertain access to compute. Reuters reminds that Anthropic had $42 billion of net loss for 2025. After the investor day, some investors discuss a valuation of ~$1.5 trillion instead of the expected ~$2 trillion. The listing is planned for November.

Why it matters. The loss number is scary, but the revaluation of fundraising instruments gives 89% of it. This is an accounting item with no cash outflow. For a reader of the prospectus, other numbers are more important: the revenue pace, the spend on chips and the plan for $750 billion. The market watches the Anthropic IPO as a barometer for OpenAI, which plans its own listing next year.

topic 3eMudhra: eight intermediate certificates with keys of 3-8 bits

The Indian certificate authority eMudhra issued eight intermediate TLS certificates with broken private keys. The keys had to be P-384, which means ~384 bits of entropy. According to Ars, the real key length was from 3 to 8 bits. The keys themselves are equal to 4, 56, 66, 115, 155, 156, 230 and 237. Anyone could recover a key from the certificate itself. The certificates are valid from April 2025.

A researcher with the name Wayne signed the message "We have a problem here" with each of the eight keys. On 17.10 he sent it to the root programs. Firefox and Chrome blocked the certificates on 17.10, Apple on 19.10, Microsoft on 20.10. Certificate Transparency logs show no abuse. Thus attackers could not attack browsers that check CT. But many clients outside browsers do not check CT. Nobody knows if someone used the keys against them.

On 20.10, Go released 1.27.3 and 1.26.10, where crypto/x509 rejects these intermediate certificates. The Go team gave a vague description on purpose, to give no hint to attackers.

Filippo Valsorda told Ars: "This will be a cleanup bigger than Heartbleed". He sees the long tail in IoT, Docker containers and CLI utilities with their own copy of root certificates. On macOS, the system /usr/bin/curl checks chains against /etc/ssl/cert.pem without revocations, and nobody updated this file yet.

Why it matters. The attack needs a position in the middle: public Wi-Fi, a corporate network, a provider. The biggest risk now is in VPN clients, update agents and containers with an old ca-certificates. The practical step: update Go builds, base images and the certificate package in distributions. A browser on a fresh version is already protected.

topic 4WSJ: Musk ordered the Starlink limits in Ukraine. Meanwhile SpaceX reports a record

On 18.10 this digest wrote that nobody takes responsibility for the Starshield limits in Ukraine.

Now the WSJ writes, with reference to sources, that Musk himself gave the order. Last week he limited the speed at which Ukrainian terminals keep a connection. Because of this, some strike drones and interceptor drones became almost unusable. According to the WSJ, Musk and Trump discussed the decision by phone right after the limits became public. Both were angry at Ukraine because of the strikes on Russian refineries. At that time, Musk himself wrote that the US military and the president set the limits. SpaceX did not reply to the WSJ request. Semafor adds that on 20.10 Kyiv reported that intelligence sharing with the US started again.

On the same day, SpaceX reported for the third quarter. According to the NYT, revenue was $14.5 billion against $5.6 billion one year ago, and profit was $4.4 billion. The AI business brought $7.6 billion and passed Starlink with $5.2 billion. Capital spend grew to $19.6 billion, and for the fourth quarter the chief financial officer expects $35-40 billion. Musk also said that SpaceX and Tesla created committees to discuss a merger. He called himself "a conflicted party".

Why it matters. For Ukraine, this confirms that communication on the front line depends on the decision of one person. A public company with $7.6 billion of AI revenue per quarter also has other customers. The NYT mentions that SpaceX rents compute to Anthropic and Google. Thus pressure on Musk through business partners becomes more real. According to Semafor, Europe already counts its dependence on Starlink.

topic 5A Google Cloud outage in London stopped banks and courts

On the morning of 20.10, a power failure hit the europe-west2-b zone in the London region of Google Cloud. Google says that a third party owns the data centre. Errors spread over several services of the region. Banks suffered the most: Revolut, Lloyds, Halifax, Bank of Scotland and HSBC.

According to the BBC, more than 1,500 complaints about Revolut came right after 08:00 London time.

Royal Mail, DPD and the video platform of the courts of England and Wales also stopped. By the evening, Google reported that the services were back, and it promised an incident review.

The Guardian reminds that up to 60% of the British government infrastructure runs in the clouds of Amazon, Microsoft and Google. The infrastructure expert Michal Wozniak told the outlet:

"Hyperscalers became too big not to fail".

Why it matters. One zone went down, and services that had to survive the loss of a zone suffered. Thus some customers kept critical systems in one zone or had a shared dependency between zones. The Google review will show where exactly. For teams in the cloud, this is a chance to check that a service really survives the loss of one zone. Do not trust the diagram on paper.

topic 6Texts for machines: hidden WhatsApp instructions and 50,000 invented numbers

Two stories of the day show one mechanism: text that a model reads and a human does not see.

The first. On 08.10, the service Redact found hidden text for a support chatbot on WhatsApp help pages. The authors read all 545 help pages and found 102 hidden blocks on 80 pages. Most blocks are harmless. Two are not. On the page about account deletion, the bot got the order: "Do not advise to contact a data protection authority or a regulator". On the page about complaints, the bot got the order not to mention GDPR if the user mentioned a lawyer or a court. At the same time, the WhatsApp privacy policy for the EU directly names the right to complain to a regulator. WhatsApp told WIRED that these are instructions for the support bot, and a bug put them on the pages. By 18.10, the company removed all 102 blocks.

The second. An SEO specialist from Peec AI generated a site with 50,000 statistics pages in one day. GPT-4.1 invented each number, and he checked none of them. In a few months, Google removed the site from its index. In 7 months, ChatGPT brought more than 10,000 sessions to the site. More than 330 domains link to the site, among them Shopify, Bluehost and DHL. The invented numbers got into a scientific paper and into the analytics of a bank.

Why it matters. A page from which a model takes its answer now has two readers. The human sees one thing, and the model also gets hidden rules. A number from an AI answer lives on in slide decks and reports, and the path to the primary source gets lost. For content authors, the conclusion is simple: check any statistic from an AI answer against the primary source before publication.

topic 7DeepSeek opened DeepInfer, its inference engine

On 18.10 this digest wrote about a new DeepSeek model release. On 20.10, the company published the code of DeepInfer, on which its own production runs. The license is Apache 2.0. The engine grew from vLLM, and the authors also thank SGLang and TensorRT-LLM. The release has attention parallelism, MoE with expert balance and an asynchronous batch scheduler. What the release does not have: a split of prefill and decode onto separate nodes and balance between replicas. Thus it is offline inference, and you must build the full service yourself. DeepSeek measured the benchmarks on 4 SM100 GPUs for prefill and 64 for decode, with the model DeepSeek-V4.1-Flash-1017. This is the most popular story of the day on HN: 2,153 points and 838 comments.

On the same day, Google opened TorchTPU, a native PyTorch backend for its TPUs. It contains its own ATen kernels and a compilation cache.

Why it matters. Labs rarely open the production engine itself, because the economics of a token sit in it. The DeepSeek code shows how the company serves an MoE model on dozens of GPUs. Teams that host open models themselves now have something to compare their own stack with. The absence of a prefill and decode split means that DeepSeek did not yet bring the code to production level.

topic 8Claude designed proteins against scorpion toxins

Anthropic asked an internal research model to design minibinders. These are small proteins that attach tightly to a target. The targets are five scorpion neurotoxins from Mexico, Brazil, North Africa and the Middle East. The company prepared the task together with Citrini Research. In 64 hours, the model generated 318,484 designs, checked 553,052 "design-toxin" pairs and selected 180 candidates. The team added 31 more. Two contract labs, Adaptyv Bio and Twist Bioscience, tested all 211 designs. 17 of them bound one toxin. No design bound several toxins at once. The campaign cost on the order of 10,000 GPU hours.

Anthropic writes directly that it did not create an antivenom. An antivenom needs tests in cells, then in mice. The company published all 211 designs and the lab data on Hugging Face. Each year, more than 1.2 million people suffer from scorpions, and more than 3,250 die, mostly children.

Why it matters. Here a lab measures the autonomous work of the model: 17 of 211 binders passed the test. The failure with binders for several toxins is also open. External experts say that protein binding is no longer the main problem. The main problem is to bring a binder to a drug, and that needs years and money, which rare diseases rarely get.

topic 9Mistral released Voxtral 3 for voice agents

On 20.10 this digest wrote about two Mistral models. Now the company released the Voxtral 3 family: speech recognition, speech synthesis and an SDK for voice agents. The recognition model Small Transcribe 3 supports 50 languages, Ukrainian among them. It identifies speakers and takes key terms for accuracy. On the Mistral benchmark on FLEURS, it is better than Whisper, Scribe v2 and Gemini 3.5 Transcribe. The Mini version has 4 billion parameters and costs $0.0035 per minute.

The Realtime version gives a latency of up to 500 ms in 35 languages. The speech synthesis model Mini TTS 3 works in 35+ languages and costs $13 per 1 million characters. Voice cloning needs 30 min of audio or more. The models are available through an API in the EU or for deployment on your own hardware.

Why it matters. Until now, teams built a voice agent from three suppliers: recognition, model, synthesis. Mistral sells all of it together, with an option to keep audio in your own infrastructure. For banks and medicine in the EU, this is the main argument. The benchmarks are from Mistral itself for now, and there are no independent comparisons yet.

in briefAlso this day