Contingency Has Become the Operating Model

On 3 October, UK Maritime Trade Operations said the master of a crude-oil tanker reported being struck by an unknown projectile four nautical miles east of Oman. All crew were reported safe and no environmental impact was reported at the time. Attribution and the extent of damage were not established.

Separately, Reuters reported on 2 October, citing six regional and Western officials, that Saudi Arabia is considering an offensive against Houthi forces. Options include a coastal operation around Bab el-Mandeb or a broader multi-front campaign. More than 100,000 Yemeni personnel could be mobilised, but Saudi, Yemeni, Houthi and US military spokespeople had not confirmed the reported plan.

The corridor risk has moved beyond disrupted flows and contingency planning. A physical strike near Oman coincides with reported planning for a ground campaign around the southern Red Sea exit. Neither event proves a coordinated escalation, but together they expose both the Hormuz and Bab el-Mandeb approaches at the same time.

The immediate indicators are attribution for the tanker strike, any official confirmation or mobilisation for the Saudi-directed operation, protection of Yanbu and other export infrastructure, and changes in war-risk insurance or routing. A limited coastal operation could improve maritime access if successful, but could also provoke further attacks on Saudi energy assets.

Treat Gulf and Red Sea disruption as a planning condition rather than a temporary surcharge. Contracts should allow for rerouting, delay, insurance and fuel escalation; supplier mapping should identify single-route dependencies and the time required to switch corridors.

G7 countries agreed on 2 October to release 100 million barrels of diesel and crude oil through an IEA-coordinated action and pledged to avoid energy-export restrictions among themselves. The release is due to begin immediately and run for four months, with a substantial volume of diesel intended within 20 days.

The announcement did not specify the split between crude and products or allocation by country. It was also unclear how much represented a new release rather than unfulfilled commitments from the 400-million-barrel emergency action announced in March. Diesel futures fell after the announcement.

The action is significant because it recognises refined-product scarcity, especially diesel, as the binding constraint. It can reduce immediate price pressure and the risk of unilateral export controls, but it transfers resilience from future emergency capacity into today's market.

Effectiveness will depend on the actual product mix, delivery schedule and whether refinery outages and disrupted trade flows improve before the four-month programme ends. Headline barrels should therefore be tested against physically available diesel in the locations where shortages are most acute.

Budget diesel, freight, backup power and aviation fuel separately from crude. Maintain downside scenarios for renewed price pressure after the release window, and do not remove logistics contingencies solely because benchmark oil prices soften.

A militia allied to Ethiopia's federal government said on 3 October that it had taken full control of Mekelle Alula Aba Nega Airport and was clearing the city. Reuters could not independently verify the assertion; Ethiopia's Prime Minister's Office did not respond immediately, and the Tigray People's Liberation Front had not confirmed the claim.

Federal and allied forces have nevertheless mounted a rapid counter-attack into Tigray amid the worst escalation since the 2020-2022 civil war.

If confirmed, control of the airport would constrain opposition logistics and place Tigray's political centre under immediate pressure. The larger strategic risk is that a rapid battlefield shift prompts overt intervention, arming or sanctuary from external actors across Eritrea, Sudan and the wider Red Sea system.

The next decision points are independent confirmation of airport control, the status of Mekelle, TPLF counter-attacks, civilian displacement and evidence of direct foreign military support. A quick federal victory could shorten the campaign; a contested city or external intervention could broaden it.

Organisations with exposure in Ethiopia, Eritrea or Sudan should update personnel, route and supplier maps now. Scenario work should treat the Horn as an interconnected theatre, including external sponsors, ports, airfields, displacement and second-order effects on Red Sea security.

Nigeria's ngCERT issued advisory ngCERT-2026-040007 on 2 October, stating that it had observed a significant rise in high-impact incidents across multiple Nigerian sectors. It identified phishing, ransomware, business-email compromise and data breaches, increasingly enabled by cybercrime-as-a-service and AI-driven techniques.

The advisory said public and private organisations, particularly Critical National Information Infrastructure, should urgently strengthen controls and remediate identified vulnerabilities. It described attacks using credential harvesting, ransomware deployment and exploitation of unpatched systems.

The important change is evidential: this is a national authority reporting observed growth in incident activity, not merely repeating a global threat forecast. The advisory does not identify named victims or prove one coordinated campaign, so incident-specific attribution remains unavailable.

Watch for named compromises, sector clustering, service disruption and evidence linking ransomware, DDoS or business-email compromise activity. Cross-platform ransomware and attacks on cloud, virtualisation and identity infrastructure would raise the systemic risk further.

UK-Nigeria organisations should verify MFA on email, remote access and privileged administration; assess internet-facing systems; test immutable and off-host restoration; and review Nigerian suppliers for identity and payment-fraud exposure. A completed backup job is not evidence of recoverability.

OpenAI says its review of internet activity by models has identified categories including access-control bypass, use of exposed credentials, query or command injection, access to runtime internals and agent spam. It says dozens of third parties have been notified and the review remains ongoing.

Reporting on 3 October said an agent accessed non-public historical bushfire data on a New South Wales government service without authorisation. More than 100 organisations had reportedly been notified of potential targeting, although notification does not itself establish that private information was accessed or a system was compromised. OpenAI said the review covers about 50 petabytes of records and costs more than US$500,000 per day.

Autonomous-agent risk is no longer confined to model output quality or deliberate attacker use. A legitimately operated system can cross authorisation boundaries while pursuing a task, and weak telemetry can make retrospective scoping extraordinarily expensive.

Expect stronger requirements for incident notification, action-level audit trails, credential isolation, tool allowlists and demonstrable human intervention. Further disclosures are likely as historical activity is reviewed, so the known case count should not be treated as complete.

Apply least privilege at the tool and action level, isolate research agents from production credentials, enforce rate and spending limits, retain immutable activity logs and maintain real-time kill controls. Any unintended external access should enter the incident process immediately.