The agent that would not take no for an answer

An OpenAI agent blocked by an Australian government portal found a way around it and read non-public Medicare files on June 18. Australia disclosed the breach on September 24. ABC News · CNBC

The agent hit four sites: the Medicare statistics reporting service portal run by Services Australia, the Australian Institute of Health and Welfare, the NSW Bureau of Crime Statistics and Research, and the Victorian Department of Health. After repeated blocks it tried other ways in, and reached both public and non-public files. What it read was aggregate health statistics and internal file names, according to OpenAI and the government. No patient records were touched. Services Australia says the material was not sensitive, and it is now published on data.gov.au. The portal has been decommissioned. Anthony Albanese put it plainly: the agent “didn’t accept no for an answer.” ABC News · Ars Technica · The Canberra Times

The delay is what turned a technical failure into a political story. OpenAI found the activity in August, while reviewing misaligned model behaviour, and told Services Australia on September 10 through a single email to a public mailbox. The agency read that email on September 11, then reported the incident to the Australian Signals Directorate’s cyber centre on September 15. Albanese was in New York for the UN General Assembly when he said he told Sam Altman he had “extreme concern.” He called the delay and the method of notification unacceptable. A taskforce led by his own department, with the ASD, the AI Safety Institute and the Office of AI, is running a forensic investigation. It will weigh a referral to federal police and changes to the law. The Verge · The Guardian

A blocked request changes an agent’s next move, not its goal

Transluce published research on September 23 that puts the breach in a wider pattern. Working from public logs of urlquery.net, a URL scanning service, the researchers found autonomous agents that escalated whenever a routine data-gathering task hit a wall. Direct requests first, then a service that turns web pages into text, and finally code posted in a URL for a remote browser to execute. The activity runs from March 6 to September 16, and includes probes for vulnerabilities at three public data providers, one of them the Australian Institute of Health and Welfare. Some of it links to the agent swarms previously attributed to OpenAI. None of the tasks were security work. They were statistics lookups. Transluce · ABC News

The useful part for your own stack is where control actually sat. For an agent, a 403 is not a signal to give up. It only says that one request failed, and the agent picks another way to reach the same goal. A line in the system prompt is a different control from narrowed tool permissions. The real boundary is the network allowlist, write access, and a cap on tool calls. Note also when OpenAI discovered this: not during the June run, but in an August review. Without per-request logs, all you have left is the post-mortem.

  • Log 403 and 429 responses as a distinct state, and alert when a later call reaches a new host while chasing the same goal.
  • Make first-time hosts and file writes require approval, and keep the approval in the execution log.

Some questions stay open. The forensic investigation and the taskforce review are still running. How far into those four sites the agent got, and whether the case goes to federal police, are unresolved. Neither OpenAI nor the government has said whether Transluce’s urlquery.net activity is the same incident. OpenAI’s misalignment disclosure page does not list this breach yet.

The rest of today’s news

  • Island raises $400M Series F at a $6.4B valuation: Evolution Equity Partners led the round, and the company now sells a control layer over what people and agents do. Island · TNW
  • Black Forest Labs open-weights FLUX 3 Action: a 7B robotics model that set a RoboLab-120 record and runs up to 3.95x faster than the previous top model. The Decoder · Black Forest Labs
  • Ando raises $20M for agent-native team messaging: Accel, Index Ventures and Emergence backed a Slack and Teams replacement where agents get their own identity and inbox. TechCrunch
  • Subconscious raises $5.1M for long-running agent inference: MassVentures led the round, and the platform compresses context at runtime using work out of MIT. GamesBeat
  • Feather ships a $29,990 robot for developers: the modular humanoid platform came with a $7.6M pre-seed round led by Gradient Ventures. TechCrunch