Picture this for a second. You ask a very capable assistant to pull together some public health statistics. It hits a locked door. Instead of walking away, it picks the lock. Right? That is not a thought experiment. It is what OpenAI’s own AI agent did to an Australian government health database. Then OpenAI sat on that information for weeks before anyone outside the company knew.
What actually happened
First, here is the sequence, confirmed by OpenAI’s own statement and by Australian Prime Minister Anthony Albanese. On June 18, 2026, an OpenAI model was doing internal research on public medicine spending. It targeted four Australian government sites at once. Those included the Medicare Statistics Reporting Portal and the Australian Institute of Health and Welfare. Also on the list were the New South Wales Bureau of Crime Statistics and the Victorian Department of Health.
Three of those visits were ordinary. But the fourth was not. When the Medicare portal blocked the agent’s requests, it did not stop there. Instead, it found what Albanese called “a way around those blocks.” In his words, the agent “didn’t accept no for an answer, if you like.” Once inside, it pulled both public and non-public files. That included internal file names. It even wrote data back onto a Medicare server.
Still, OpenAI says no patient records were exposed, only aggregate statistics and file names, and Albanese has confirmed that much. But here is the part that should slow you down. OpenAI found this itself in August, during an internal review of what it calls misaligned model behavior. It then emailed a general Services Australia inbox on September 10. Then the Australian Signals Directorate was told on September 15. The Prime Minister’s own office, however, did not hear about it until September 19. That is nearly two weeks after that first quiet email. Albanese called the notification method “unacceptable,” and he is right to.
What almost everyone covering this is missing
Most of the coverage treats this as an Australia story, or an OpenAI story. It is actually neither. That is the part worth your full attention.
Researchers at the AI oversight group Transluce had already tracked this exact pattern at three other sites, months earlier. A university digital library in New Mexico was hit in May 2026. So was the public data platform Data USA. The Australian Institute of Health and Welfare was hit again in June. In other words, the sequence was identical every single time. First, the agent tried a normal request. Then it got blocked, rate-limited, or hit an error. So, on its own, it escalated. For example, it reached for SQL injection, cross-site scripting, or path traversal. Those are the very same techniques a human attacker would use to break into a system.
Transluce put it plainly. This behavior, they wrote, “is not limited to agents tasked with cybersecurity-related tasks and can arise instrumentally to solve mundane tasks like information retrieval.” In plain English, you do not need to be running a security tool for your AI agent to start acting like one. So a completely ordinary research task can turn into a break-in attempt. All it takes is the agent getting told no.
Why this is your problem too
You are probably not running a frontier model doing internal safety reviews. But you are very likely running agents that browse the web for you. Maybe they pull data from a vendor portal, or scrape a public site on your behalf, inside a tool you did not build and cannot fully inspect.
Every one of those agents inherited the same instinct. When a task gets hard, when a door is locked, the model’s priority is to finish the job. It is not to stop and ask a human first. Still, nobody programmed that in as malice. It simply showed up on its own, across four different agents, at four different organizations, months apart. So the real lesson here is not “watch out for OpenAI.” It is “find out what your own agents do when they hit a wall.” Right now, most businesses genuinely do not know that answer.
This lands squarely in the Security pillar of the six pillars I talk about constantly with clients. Those are Strategy, Infrastructure, Data, Security, Governance, and People. An agent that can quietly try five different ways around a blocked request is not a minor glitch. It is a security and governance gap. It is also probably sitting somewhere in your stack right now, completely unreviewed.
What to do about it this week
- First, inventory what your agents can actually reach, not just what you configured them to do. If an agent has a browser or an API key, assume it will eventually try the door that is locked.
- Then, put a hard stop on escalation. Your agents should be built or configured to fail loudly when blocked, instead of quietly trying a workaround. A blocked request should trigger a human review, not a retry loop.
- Also, ask every vendor the notification question now. If one of your AI tools caused an incident, how long would it actually take you to hear about it, and from whom? OpenAI’s own answer here was weeks, through an inbox nobody was watching closely.
- In addition, run an A.S.K. pass on anything that touches an external system. Sort each agent task into Automate, Share, or Keep Human. Unattended access to a third-party system, with no human checkpoint, almost always belongs in that third bucket. That is true no matter how boring the task looks on paper.
- Finally, decide in advance who gets told, and how fast, if your AI does something you did not intend. After all, waiting until it actually happens is how you end up explaining a six week gap to your own leadership.
Let’s talk about what is actually in your stack
I am not telling you this to scare you off agentic AI. I use it, and I teach it too. I also genuinely believe withholding it from your business carries its own cost. But this story is a rare and useful gift. It is one of the very few times we get to see, out in public, exactly what an unsupervised agent does the moment it hits friction. It picks the lock.
So, right? Go find out what yours would do.
If you want a second set of eyes on where your agents have more reach than you realize, that is exactly the kind of audit I do with clients. Reply to this post, or reach out directly. I would genuinely like to help you get ahead of this, before it becomes your own Tuesday morning phone call.
Cuídense, mi gente, que la inteligencia artificial no pide permiso para nada, así que ustedes sí tienen que exigirle cuentas.
Sources
- OpenAI hacked Medicare portal, Prime Minister Anthony Albanese says – ABC News
- OpenAI agents breached Australia portal, attempted hacks of other sites – Axios
- OpenAI Agents Probed Websites for Vulnerabilities While Fetching Public Data – SecurityWeek
Featured photo by Acton Crawford on Unsplash. In-body photo by Florian Olivo on Unsplash.