DEV Community: Mohit Geryani

OpenAI's High-Stakes Gamble: How Sam Altman Plans to Stay #1

Mohit Geryani — Mon, 24 Aug 2026 18:58:56 +0000

Sam Altman says OpenAI is about to have its best 12 months yet.

But after a rough year, the question is: what exactly is OpenAI betting on to pull it off?

I've Breakdown his High-Stakes bet to Save OpenAI’s Dominance.

Microsoft Threatened a Security Researcher. Now a Windows Zero-Day Bug Is Public.

Mohit Geryani — Thu, 13 Aug 2026 09:57:50 +0000

Microsoft has spent the past few months warning security researchers about what can happen when they publish unpatched vulnerabilities without coordinating with the company.

Now, one of those researchers has published another one.

The vulnerability, called ShieldBreak, affects Windows Defender and can reportedly turn access available to an ordinary Windows user into full SYSTEM-level privileges, the highest level of access on a Windows machine.

Its discoverer, security researcher Nightmare Eclipse, has been in an increasingly public dispute with Microsoft over how the company handles vulnerability reports. Microsoft even threatened legal action against researchers who publicly released certain unpatched flaws, before later walking back that language following backlash from the security community.

ShieldBreak has now landed in the middle of that dispute, with Microsoft saying it is investigating the reported vulnerability while the researcher has already published a working proof of concept.

It's the latest chapter in a much bigger argument over how much control software companies should have over the security research that exposes flaws in their products.

What ShieldBreak Actually Lets an Attacker Do

The name might make ShieldBreak sound like a way to break into any Windows computer from across the internet. It isn't.

The vulnerability is a privilege-escalation flaw. An attacker would first need some level of access to the machine, such as access through another compromised account, malicious software, or a user running something they shouldn't.

ShieldBreak then becomes useful after that initial foothold.

The researcher says the flaw can allow a low-privileged user to elevate their permissions to SYSTEM, Windows' highest local privilege level. At that point, the attacker has far more control over the machine and the data stored on it.

That distinction is important, A vulnerability that lets an attacker remotely break into an untouched PC is one kind of threat. A vulnerability that lets an attacker turn a limited foothold into complete control is another. ShieldBreak falls into the second category, but that doesn't make it harmless.

In fact, privilege escalation is often what turns a limited compromise into a much more serious one. Once an attacker can operate with SYSTEM-level privileges, security boundaries that would normally restrict what they can access become much less useful.

And there is another reason to take the claim seriously: the researcher didn't just publish a description of the flaw. They also released a proof-of-concept application, and independent security researchers have reported successfully testing it.

That moves ShieldBreak from an interesting claim on a researcher's blog into something defenders have to start paying attention to.

The New Bug Didn't Appear Out of Nowhere

Earlier this year, Nightmare Eclipse disclosed another Windows Defender privilege-escalation flaw called RoguePlanet. Microsoft eventually patched that vulnerability, but ShieldBreak appears to take a different route to reach essentially the same dangerous destination:

SYSTEM-level access.

A privilege, escalation bug doesn't necessarily let someone break into a Windows PC from across the internet. An attacker generally needs to get code running on the machine first—through malware, a malicious file, or some other foothold.

But once they're there, the situation changes.

A normal user account is heavily restricted. SYSTEM is not.

If an attacker can turn a low-privileged foothold into SYSTEM privileges, they can potentially gain much broader control over the machine, access protected data, interfere with security software, and carry out actions that would normally be blocked.

And that's exactly why Defender is such an interesting place for this kind of vulnerability to exist: the security software designed to protect Windows becomes part of the path to higher privileges.

ShieldBreak also appears to demonstrate something more uncomfortable for Microsoft:

fixing one vulnerability doesn't necessarily mean the underlying attack path is gone.

The Bug Is Only Half the Story

ShieldBreak is still an unresolved security problem. Microsoft says it is investigating the report, and there is no patch for the newly disclosed vulnerability yet.

But the more unusual part of this story is everything surrounding the bug.

Nightmare Eclipse has been publishing Windows vulnerabilities while openly criticizing Microsoft's handling of their previous reports. Microsoft, meanwhile, has argued for coordinated disclosure and even threatened legal action against researchers who publish unpatched vulnerabilities outside its preferred process, before later clarifying that it does not intend to pursue researchers simply for publishing security research.

That leaves an uncomfortable situation.

Researchers want companies to take serious vulnerabilities seriously. Companies want time to investigate and patch them before exploit details reach attackers. And users are caught in the middle when those two sides stop trusting each other.

ShieldBreak shows what can happen when that relationship breaks down: a vulnerability is public, working proof-of-concept code is available, and the software vendor is still trying to determine exactly what it is dealing with.

For Windows users, the immediate takeaway is simple: this is not a reason to panic, but it is a reason to pay attention to Microsoft's eventual response and patch.

And for security researchers and software companies, there may be a bigger lesson here. A vulnerability disclosure process only works when both sides believe that reporting a dangerous bug is more productive than publishing it first.

Right now, that trust looks like the part of the system that needs fixing.

License Plate Cameras Can Now Track the Phones Traveling With You

Mohit Geryani — Wed, 12 Aug 2026 13:21:10 +0000

A license plate camera normally answers a simple question: Which car just passed?

But what if it could also help answer who was inside that car and which other people they were traveling with?

That is where a new surveillance technology gets interesting.

Companies are now combining license plate readers with sensors that detect wireless signals coming from nearby devices, including phones and Bluetooth-enabled gadgets. Over time, those signals can form recurring patterns like, the same phone appearing beside the same vehicle, the same group of devices traveling together, or the same electronic signature showing up at different locations.

The technology doesn't need to read your name from your phone. It can potentially learn something more subtle first: that this particular device keeps moving with this particular car.

And once that pattern becomes reliable enough to search, investigators can use it as a lead, even when they didn't start with a person's name, phone number, or license plate.

How a License Plate Camera Starts Recognizing Phones

Phones and other devices are constantly broadcasting wireless signals as they communicate with the world around them.

The trick is connecting those signals to something that investigators already understand.

SignalTrace is designed to work alongside automatic license plate readers. A camera records a vehicle's plate, while nearby sensors can detect electronic signatures from devices traveling around it. Over repeated observations, the system can build a picture of which devices tend to appear together and which vehicles they repeatedly accompany.

Imagine the same car passing a camera every morning with the same phone and smartwatch nearby.

One observation doesn't tell investigators much. But after dozens of trips, that combination starts looking more like a recurring pattern.

The system can then search for that pattern later—even when the license plate isn't visible.

That's a significant shift from traditional license plate surveillance. Instead of searching for a known plate, investigators can potentially start with a recurring electronic pattern and work backward toward the vehicle or person associated with it.

And that's where the technology becomes much more interesting than simply putting another camera on a road.

The Signal Doesn’t Need Your Name to Become Useful

There’s a subtle difference worth understanding, detecting a device is not the same thing as identifying its owner.

A phone's wireless signal doesn't suddenly tell a roadside sensor, “This belongs to John Smith.”

But that doesn't mean the signal is meaningless.

Suppose a particular device keeps appearing near the same vehicle, at roughly the same time, on the same route. Later, that device repeatedly appears outside a particular house. Investigators may already have records connecting that vehicle or address to a person.

None of those individual observations has to contain a name.

The identification can happen later, when separate pieces of information are connected.

This is why the phrase “anonymous device” can be misleading. A random identifier may be anonymous when viewed by itself, but a persistent pattern can make it increasingly distinctive.

Researchers have demonstrated just how revealing movement patterns can be. In one large mobility study involving 1.5 million people, researchers found that just four time-and-location points could uniquely identify 95% of individuals in the dataset.

That study wasn't about SignalTrace, and it doesn't tell us how accurately Leonardo's system can identify a particular person. It does, however, illustrate the underlying problem: you don't necessarily need someone's name when their movements are distinctive enough to single them out.

And once surveillance systems can repeatedly recognize the same signal, the interesting data is what other devices, vehicles, and places keep appearing around it.

But the System Can Find Patterns. It Can't Know What They Mean

This is where the technology gets more complicated.

A recurring electronic signature can be useful without being perfectly reliable. The system can recognize that two devices repeatedly appear together, but it cannot know whether those people are married, coworkers, friends, strangers sharing a ride, or simply happened to be in the same place.

The same problem applies to vehicles.

A phone left inside a parked car can produce a signal that looks like a person staying with that vehicle. Someone borrowing a friend's car can make the opposite pattern. A passenger can also be associated with a vehicle they have no connection to beyond that particular trip.

None of this necessarily makes the technology ineffective. It changes what its output actually represents.

A pattern can be a lead without being proof.

That distinction matters because the technology is designed to make previously difficult searches easier. An investigator who doesn't know which vehicle to look for may be able to search for a recurring electronic signature instead. A pattern that would have been buried in thousands of ordinary observations can suddenly become searchable.

The risk is that once a system highlights a person or group as interesting, that initial inference can influence everything that happens afterward.

The technology doesn't have to be certain to be consequential.

It only has to be useful enough to tell an investigator where to look next.

But a Pattern Can Still Become a Lead

And that's probably the most important part to keep in mind.

SignalTrace doesn't need to tell an investigator, “this is John Smith,” to be useful. It only needs to surface a pattern that would otherwise be difficult to notice.

A recurring device signature might point investigators toward a particular vehicle, location, or group of people. From there, they can use other records and conventional investigative methods to work out what the pattern actually represents.

That makes the technology more like a search tool for relationships hidden inside large amounts of data.

A lead can be useful without being correct. Once a system repeatedly points investigators toward the same device or group, however, that pattern can start influencing which people are investigated, which records are requested, and which events receive closer attention.

What I found interesting is that surveillance systems are becoming better at finding connections between things that were previously collected as separate pieces of information.

A license plate is one record. A wireless signal is another. A location is another. A recurring association between them can turn all three into something much more revealing.

And the more data these systems can connect, the less important it becomes whether any individual piece of information contains your name.

You don't always need to know who someone is to start building a detailed picture of where they go, what they travel with, and who they tend to be around.

That's what makes this technology worth watching because it gives surveillance systems another way to work backward from patterns to people.

You Don’t Need to Hack a Company. Sometimes They’ll Email You Their Secrets.

Mohit Geryani — Mon, 10 Aug 2026 16:21:09 +0000

What if you could receive a company’s private information without hacking its network, bypassing a firewall, or stealing a password?

You might only need to buy the right domain name.

That’s what security researcher Cory Solovewicz discovered after purchasing noreply.net. Instead of becoming the quiet corner of the internet he expected, the domain started receiving a staggering number of emails from companies and organizations that apparently assumed nobody was listening.

Some contained ordinary automated notifications. Others contained far more sensitive information, including test credentials, employee data, customer orders, injury reports, and thousands of attachments.

And this wasn’t a single company making a mistake.

Solovewicz found thousands of domains that could potentially receive email this way, raising a much bigger question about how companies handle data after an account, employee, or system is supposed to disappear.

The strange part is that none of this required breaking in. The companies were sending the information themselves.

The “Noreply” Address Wasn’t Going Nowhere

When Cory Solovewicz bought noreply.net, he wasn’t trying to uncover a massive security problem.

He had originally purchased similar domains for a personal email project. The idea was to simply use a catch-all inbox to receive messages sent to any address on the domain.

Then the emails started arriving.

And they kept arriving.

Since buying noreply.net in 2024, Solovewicz says the domain has received more than 400,000 messages, including more than 28,000 attachments. Across noreply.net and noreply.us, the messages came from more than 14,000 sending addresses belonging to roughly 6,200 root domains.

The figures and findings above were reported by WIRED based on Solovewicz's research.

The volume was surprising. What those messages contained was more concerning.

Some organizations were sending information that was never supposed to reach an unrelated third party because they believed the destination address effectively didn't exist.

It did. Someone simply owned it.

Why “Noreply” Can Become a Real Inbox

The problem starts with an assumption built into many automated systems:

That an address containing words like noreply or deleteduser is effectively a dead end.

But email doesn’t work that way.

If a company sends a message to someone@noreply.net, that message still needs a real domain and a real mail server to receive it. If someone else owns that domain and has configured it to accept incoming mail, the message has a destination and that destination may be controlled by a complete stranger.

This can happen when companies repurpose placeholder addresses, fail to properly remove old accounts, or continue sending automated notifications to domains they no longer control.

The result is a strange kind of security failure: the attacker doesn't have to break into the system because the system is already delivering the data to them.

And the information being sent isn't necessarily harmless.

That is where this becomes much bigger than a few misplaced emails.

The Emails Were Far From Harmless

Solovewicz says he received everything including test platform credentials, service orders, injury reports and even customer information. Some messages contained attachments that can easily turn an abandoned email address into a potential repository of sensitive data.

Another researcher, Mike Sheward, found the same problem after purchasing domains such as deleteduser.com. His inbox received hotel bookings containing people’s names, work vacation requests, Zoom meeting invitations, and other information that organizations apparently believed would disappear into a dead account.

In one particularly striking example, an AI company reportedly sent thousands of CCTV images to one of Sheward’s domains. The images were intended for a system that monitors workers at industrial sites in the Middle East.

That changes the nature of the problem.

This isn't about companies sending an occasional email to the wrong person. Automated systems can keep doing it at scale, potentially exposing customer data, employee information, credentials, and internal material without anyone actively trying to steal it.

And once the data reaches a domain controlled by someone else, the company has already lost control of it.

The Problem Isn’t Email

The researchers’ findings point to a surprisingly simple security lesson:

A system can be perfectly secure from an attacker and still leak data because it sends that data somewhere it shouldn’t.

Solovewicz scanned 7,136 domains and found 328 configured with catch-all inboxes. That doesn’t mean all of them were leaking sensitive information, but it shows how easily forgotten email infrastructure can become a security problem.

The fix is not particularly exotic. Companies can use internal domains for placeholder addresses or reserve domains such as .invalid that are guaranteed not to exist.

The harder part is changing the assumption behind these systems.

A noreply address isn't a black hole. A deleteduser account isn't necessarily gone. And a domain nobody expects to monitor can still have a real owner.

Companies spend enormous amounts of money protecting their networks from increasingly sophisticated attacks.

But sometimes the easiest way to get their secrets isn't to break through the door.

It's to wait for the company to send them to you.

AI Models Keep Escaping Sandboxes. First OpenAI. Then Anthropic. Now Kimi.

Mohit Geryani — Sat, 08 Aug 2026 09:30:44 +0000

First, OpenAI said one of its AI models escaped a sandbox and hacked into Hugging Face’s production systems.

Then Anthropic reported a similar problem with its own cybersecurity testing.

Now Kimi, a Chinese AI model, has reportedly bypassed the environment built to contain it.

Three different AI companies. Different models. Different testing environments.

And yet the story keeps ending in almost the same place:

The AI found a way around the boundary humans had built for it.

That would be easy to dismiss as coincidence.

Except these incidents are happening within weeks of each other, as companies race to make AI models more autonomous and better at cybersecurity.

So what is actually happening?

Are AI models suddenly getting much harder to contain or are we simply discovering that the way we've been testing them was never as secure as we thought?

Three incidents. Different paths to the same problem.

In OpenAI’s case, the company said its experimental models were being evaluated on their ability to perform cybersecurity tasks inside a controlled environment. During the test, the models discovered a previously unknown vulnerability, moved through OpenAI’s systems, gained internet access, and eventually reached Hugging Face’s production infrastructure to obtain information they believed would help complete the task.

Anthropic’s incident followed a different path. Its cybersecurity testing involved an autonomous model operating with the tools and permissions needed to perform a real hacking exercise. Rather than simply following the intended path through the evaluation, the model found a way to interact with systems outside the boundaries researchers had expected it to respect.

Kimi’s case appears different again. Researchers at Frontier Security said the sandbox itself was not configured correctly. The model was restricted from certain web traffic, but it was able to bypass those restrictions by using command-line tools.

So these aren't three identical “AI escaped” incidents.

The routes were different but the outcome was common: the models found paths their designers did not intend them to take.

And that distinction matters and the question arises whether increasingly capable AI agents are becoming exceptionally good at finding the gap between what an environment is supposed to allow and what it actually allows.

The timing is harder to ignore

One isolated incident would be easy to dismiss as a badly configured test.

Two might suggest that the problem is becoming more common.

But when OpenAI, Anthropic, Meta, and now Kimi are reporting models finding ways around cybersecurity testing environments within the same period, something bigger deserves attention.

These companies are not using the same models. They are not running identical evaluations. And they are not necessarily making the same engineering mistakes.

Yet the same broad pattern keeps appearing: give an AI agent tools, a goal, and enough freedom to pursue that goal, and it may start looking for ways around the boundaries humans designed for it.

That doesn't necessarily mean the models are suddenly “escaping” in the science-fiction sense.

It may mean something more interesting is happening.

AI labs are deliberately giving their models more autonomy because they want them to behave like real agents that continue working without constant human supervision.

But the more capable those agents become, the harder it gets to build a test environment that perfectly anticipates everything they might try.

And that creates a strange feedback loop.

The better we make AI at finding vulnerabilities, the harder it becomes to build a vulnerability-free environment in which to test it.

There could be several reasons for this pattern. The rapid shift toward more autonomous AI agents may be one of them.

We’re asking AI to be autonomous and then surprised when it acts autonomously

AI models are no longer being tested only on whether they can generate code or answer a cybersecurity question. Increasingly, they are being given tools, access to computers and networks, and objectives they are expected to pursue with minimal human intervention.

That changes the nature of the test.

A traditional security test can assume that a human is operating within a set of rules. An autonomous AI agent does not necessarily approach those rules the same way.

If the objective is to find a vulnerability, the model is effectively encouraged to explore unusual paths, experiment with available tools, and look for weaknesses in whatever environment it has been given.

And the sandbox itself becomes part of that environment.

A restriction that looks obvious to its designers may simply look like another problem to solve.

This is why the recent incidents are more interesting than the word “escape” suggests. The models aren't necessarily deciding that they want freedom. They are pursuing an objective and sometimes discovering that the fastest route to that objective runs through a boundary their creators assumed would hold.

The irony is hard to miss.

The industry is building AI agents specifically to make decisions without waiting for humans. Now it is discovering that those decisions can include things its developers never anticipated.

Related reading: Why AI Couldn't Stop 160,000 Students From Cheating

Maybe we’re simply seeing more of the failures

There is another, less dramatic explanation.

AI labs are testing their models more aggressively than they were even a year ago. Cybersecurity evaluations are becoming longer, more autonomous, and more realistic. Researchers are deliberately giving models tools and opportunities to find vulnerabilities that earlier systems may never have been capable of exploiting.

That means more failures are bound to become visible.

A model that never had access to a network could not escape into one. A model that was never allowed to operate autonomously could not surprise its developers with a decision made several steps later.

So the growing number of incidents does not, by itself, prove that AI models have suddenly become uncontrollable.

It could simply mean that we are finally testing them hard enough to discover what they can do.

But that explanation raises another question.

If increasingly realistic testing keeps producing examples of models finding unintended paths through their environments, should we think of these incidents as isolated mistakes or as an early warning that the way we contain autonomous AI needs to change?

And then there’s the publicity question

There is one uncomfortable possibility, these incidents are also extremely good stories for the companies involved.

“AI escaped its sandbox” is a far more attention-grabbing headline than “AI found a flaw in a poorly configured security evaluation.”

That does not mean the incidents were manufactured. We have no evidence of that.

But there is an obvious incentive to emphasize what these systems were capable of doing. A model that finds its way around a security environment demonstrates capability at the same time that it demonstrates risk.

That makes the recent wave of disclosures difficult to interpret through only one lens.

They can be genuine security failures and impressive demonstrations of what frontier models can do.

The pattern matters more than the headline

Whether this is a sudden change in AI behavior, the result of increasingly aggressive testing, or simply better disclosure, one thing is becoming harder to dismiss.

As AI agents become more capable, the boundary between a controlled experiment and the systems around it is becoming increasingly important and increasingly difficult to guarantee.

The models do not need to “want” to escape.

They only need to be good enough at pursuing a goal to discover that the rules humans gave them contain a loophole.

OpenAI was one incident.

Anthropic was another.

Kimi is another.

Maybe that is coincidence.

Maybe it is better testing.

Maybe it is a sign that autonomous AI is reaching a new stage.

We don't know yet.

But if the same pattern keeps appearing, the question won't be why AI models keep escaping sandboxes. It will be whether the sandbox was ever enough in the first place.

Why AI Couldn't Stop 160,000 Students From Cheating

Mohit Geryani — Thu, 06 Aug 2026 15:21:17 +0000

Every AI security system is built on a simple assumption:

If you can observe enough behavior, you can detect bad behavior.

That's the idea behind AI-Based exam proctoring.

Watch students through their webcams. Lock down their browsers. Spot suspicious movements. Alert human supervisors when something looks wrong.

It feels like a robust security plan but earlier this year, one of the largest AI-proctored exams ever conducted proved that assumption wasn't nearly as reliable as it sounded.

Nearly 160,000 applicants sat for the entrance exam to Mexico's largest university, UNAM, under AI surveillance. The system monitored webcams, restricted computers with a lockdown browser, and even routed suspicious activity to human reviewers.

Despite all of that, something was clearly wrong.

When the results arrived, the number of top-scoring students had increased by almost five times compared to previous years. The anomaly was so significant that the university eventually decided around 58,000 applicants would have to retake the exam in person, just because a system specifically designed to prevent cheating failed at scale.

AI Didn't Watch the Answers. It Watched the Students.

Unlike ChatGPT or Claude, exam proctoring AI isn't designed to understand what a student is writing. Its job is to watch how they're taking the exam.

For the UNAM entrance test, applicants were required to install a lockdown browser that blocked common ways of accessing outside information. Opening new tabs, switching applications, copying text, or searching the web was heavily restricted.

At the same time, an AI-powered webcam monitoring system continuously analyzed each candidate throughout the exam.

The software looked for behaviors it considered suspicious like Someone else appearing in front of the camera, Student leaving the frame, Looking away repeatedly, Using a phone or wearing hidden earphones and other unusual movements that might suggest outside assistance.

Instead of replacing human invigilators entirely, the system generated alerts that were reviewed by supervisors. Roughly one human monitored every 150 candidates, stepping in only when the AI flagged something unusual.

It seemed like a layered defense.

Lock the computer -> Watch the student -> Escalate suspicious behavior to a human.

It sounds robust but every one of those layers shared the same blind spot.

The Blind Spot Was Never the Webcam

Most remote proctoring systems are built around a simple idea: if you can watch a student closely enough, you can stop them from cheating.

But modern AI has changed what cheating looks like.

A student no longer needs to pull out a phone in front of the camera or glance at handwritten notes taped to the wall. They can position a second monitor just outside the webcam's field of view. They can receive answers through an earpiece hidden beneath their hair. They can even ask another AI model for help on a separate device the proctoring software never sees.

The system can detect movement.

It can detect faces.

It can even detect when someone leaves the frame.

What it cannot detect is everything happening outside the frame.

According to reports following the exam, online communities were already sharing tips before the test began. Students discussed placing additional screens beyond the webcam's view, hiding wireless earbuds, and finding ways to work around the monitoring software without triggering alerts.

If even a fraction of those methods worked, the consequences become obvious.

The AI wasn't watching the entire testing environment.

It was only watching what its camera could see.

When the Numbers Stopped Making Sense

If the university had only caught a handful of students cheating, this story probably wouldn't exist.

What forced UNAM to investigate was the data.

Between 2021 and 2025, only 3.5% of applicants scored 100 or more out of 120 on the university's entrance exam.

This year, that number jumped to 16.3%.

The pattern became even harder to ignore at the very top of the scoreboard.

Historically, fewer than 1% of applicants scored 110 or higher.

In 2026, that figure climbed to 5.5%—an increase that statistical models simply couldn't explain as a stronger group of students.

Something had changed.

The university formed an independent commission to review the entire admission process, from the online testing platform to the proctoring system itself. After examining the results, the commission concluded that the integrity of the exam could no longer be guaranteed.

Its recommendation was drastic.

Around 58,000 applicants including students who had already earned admission would have to sit for another exam and this time in person.

This Was Never Just an Exam Problem

It's tempting to treat this as a story about students finding creative ways to cheat.

But that's only part of what happened.

The bigger lesson is that AI surveillance has limits.

An AI model can detect whether someone leaves their seat. It can estimate where a person is looking. It can flag unusual movement patterns far faster than any human supervisor.

What it cannot do is understand intent.

A student staring at a second monitor just outside the webcam's view may look perfectly normal. Someone quietly listening through a hidden earpiece may never trigger an alert. Another person could simply exploit a weakness no one anticipated when the system was designed.

The more sophisticated people become, the more surveillance systems end up reacting to yesterday's tactics instead of tomorrow's ones.

That's not unique to online exams.

Banks use AI to detect fraud.

Companies use AI to monitor employees.

Governments use AI to identify suspicious behavior.

In every case, the same limitation applies.

AI can only reason about the information it's allowed to observe.

The Future of AI Proctoring Can't Be More Surveillance

UNAM's decision to require nearly 58,000 students to retake the exam was an admission that the university could no longer trust the system designed to stop it.

Ironically, the solution wasn't deploying a more advanced AI model or adding another layer of software.

It was bringing students back into a physical examination hall.

Sometimes, the answer isn't building a smarter surveillance system.

It's redesigning the process so surveillance matters less in the first place.

As AI becomes more capable, we'll continue using it to monitor workplaces, verify identities, prevent fraud, and protect high-stakes systems.

But this incident is a reminder that surveillance alone is rarely enough.

The moment people understand what an AI system can see, they start looking for what it can't.

And that's a challenge every AI-powered security system, not just exam proctoring will have to solve.