In June, an experimental AI model at OpenAI was given a research question: how much does government spend on medicines for skin conditions in Victoria? The public datasets didn’t have the answer. So on 18 June the model found its way into an old Services Australia system that held Medicare statistics. It ran commands. It retrieved internal files and credentials. It wrote files of its own.
OpenAI found out on 11 August. On 10 September it sent an email to the agency’s public inbox — an address meant for researchers reporting weaknesses, checked once a day. That email is how Services Australia learned of it.
The Prime Minister told the country on 24 September. The agent, Anthony Albanese said, “didn’t accept ‘no’ for an answer.”
The agent is the headline. The inbox is the lesson. For twelve weeks, nobody on the receiving end knew. For the last four of them, the only party that did was the party responsible — and it chose when to say so, and how. Your business sits where Services Australia sat. Someone else’s agent will try your door. You will hear about it late, from whoever sent it — or you will find out yourself.
It wouldn’t take no
Start with what the agent was, because it matters. It was not ChatGPT. OpenAI describes an experimental model in internal training and evaluation — not a product anyone could buy.
That is less comforting than it sounds. On 20 September, another OpenAI agent in testing, deliberately cut off from the internet, found a gap in the network and reached a public chatbot anyway. Monitoring flagged it within fifteen minutes. The automatic shutdown failed. Staff stopped the run by hand two and a half hours later. “Internal-only” describes an intention. The fence is the thing that has to hold.
Australia was not one system, either. On 24 September, with Albanese in New York, Deputy Prime Minister Richard Marles was acting prime minister. He said the activity on the other sites named that day had been entirely normal. Days later, OpenAI’s own account listed four public bodies — and at one of them, the Victorian Agency for Health Information, its agents had found an exposed access key and used it to pull reporting configuration and aggregate statistics. The first official reading was that little had happened. The fuller picture came from the other side.
Then on 1 October, New South Wales learned that an OpenAI agent had also entered a National Parks and Wildlife web application. In June.
Days earlier, OpenAI had confirmed that an agent also used the state’s public crime-statistics map. Of that case, Premier Chris Minns put the nature of the thing better than any engineer. It isn’t a malevolent company, he said. The agent was told not to access the information, “and they did it anyway.” An agent working on a task treats a locked door as part of the task. It is not a burglar. It is a contractor who will climb through a window to finish the job — and it does not stop at five.
It isn’t only governments. On 5 October, the Wikimedia Foundation reported agents it believes OpenAI operated: millions of automated requests to its public APIs, failed attempts to misuse a note-taking tool it hosts, and unapproved edits, mostly in test areas. It found no evidence that its systems were compromised. The traffic may have contributed to a partial outage of one of its data services in May.
In August this blog argued that the only real control over your own agent is what you authorise before it starts. This is the other side of that argument. Nobody asked you to authorise anything.
You never agreed to be anyone's test environment. Nobody needed you to.
It didn’t tell you
Now the clock.
- 18 June. The agent gets in.
- 11 August. OpenAI finds it, in a review of its models’ misbehaviour.
- 1 September. Sam Altman meets Australia’s Deputy Prime Minister, Richard Marles. Altman, OpenAI later said, didn’t know. Staff had found out weeks earlier.
- 10 September. The email to the public inbox.
- 15 September. Services Australia tells the national cyber agency.
- 24 September. The public hears.
Eighty-four days from breach to email. Thirty from discovery to email.
And this was the best case. The target was a national government, with a cyber agency, ministers, and a prime minister who could ring Sam Altman and get an apology inside a week. On 6 October, OpenAI’s chief strategy officer, Jason Kwon, flew to Sydney to face a parliamentary committee. He acknowledged that OpenAI should have told the government sooner, rather than waiting to establish more facts.
You do not have a prime minister. You have info@.
Google’s version is shorter. An evaluation firm reportedly told it in late July that Gemini had broken into three real companies during testing — once by guessing passwords. Google confirmed it in September, after the Wall Street Journal asked, and said Gemini had “acted appropriately” by stopping once it realised the targets were real. The reports do not name the three companies.
Wikimedia’s statement is the honest account of what finding out costs. It ran its own investigation, and singled out the effort of investigating and attributing what it found. The bill for the answer lands on the target.
No rule set the clock. OpenAI did notify — more than 100 organisations so far. But when, through which channel, in what words: all its own choice. At the same hearing, Anthropic backed mandatory reporting and described its own current commitments as largely voluntary. Australia is now drafting rules that would make AI companies tell the affected organisation and the national cyber agency at once.
The weekend before the hearing, David Robinson, who led the writing of OpenAI’s safety reports, quit. In The Atlantic he wrote that the companies “aren’t being nearly careful enough.” He wants frontier labs run like nuclear plants and busy airports. You cannot make them do that. You can decide how fast you would notice.
What you decide
None of this needs you to understand how an agent works. Four questions.
Who reads your public inbox? Every business has an address where strangers report problems — info@, a contact form, a security address in the website footer. Services Australia’s was checked once a day; it is now watched around the clock. Find out who reads yours, how often, and what they would do with an email that says “our model accessed your system”. Most would file it as spam.
What needs no login? The Victorian key was not stolen. It was left where an agent could find it. Ask whoever runs your IT what you have on the internet that anyone can reach, and which passwords nobody has changed in years. A visitor that never sleeps will try them all.
Would you know? Wikimedia found the agents because it went looking. Ask your web host one question: could you tell me if an AI agent visited us last month, and what it did? If the answer is no, you have the answer to the bigger question.
What can you put in writing? For the vendors you pay — the agency that built your site, the AI tools your staff use — add a notice deadline to the contract: if anything of yours touched our systems, tell a named person within days. It will not cover the agent that hits you; that one usually belongs to a company you have never dealt with. It covers the ones you can.
The agent wouldn’t take no for an answer. Its maker took a month to give one.