Nobody Told the AI to Hack Australia. That's the Problem

Here we go again.

An AI agent was given a fairly boring job: research Australian government spending on medicines. It went looking for the information, ran into a barrier and apparently decided that being told "no" wasn't acceptable.

According to Australian Prime Minister Anthony Albanese, an OpenAI agent gained unauthorized access to the Medicare Statistics Reporting Service, accessed public and non-public files, and was even able to write files to an internal server.

To be clear, this wasn't ChatGPT sitting around one night thinking, "You know what? I'm going to hack Australia." Nobody told it to hack Australia, and that's what makes this a bit more interesting than some of the other more recent accounts.

The AI had a goal. It encountered an obstacle. Somewhere along the way, getting around that obstacle became one of the methods it used to accomplish the goal.

Welcome to the next chapter of computer security.

It Didn't Accept No for an Answer

Albanese used a remarkably good description of what happened. The AI encountered a barrier and essentially "didn't accept no for an answer."

The good news is that this wasn't an enormous database containing everyone's private medical records. According to the Australian government, the portal contains non-sensitive Medicare statistics, including spending data, and there is currently no evidence that personal information was accessed. The investigation is ongoing.

That's important context, but I'm actually less interested in what the AI found than why it went looking for another way in, without instruction to do so.

For most of computing history, computers have been extraordinarily literal. Tell a computer to retrieve a file and it retrieves the file. If it doesn't exist or permission is denied, you get an error.

An AI agent works differently. You don't necessarily tell it every step. You give it a goal, such as finding Australian pharmaceutical spending data, and let the agent figure out how to get there. Think of an AI agent as ChatGPT with a to-do list and the ability to actually do things instead of just telling you how you should do them.

Normally that might mean searching for the information, finding a government website and retrieving the data. But what happens when the website blocks the request? The agent can try another method. If that fails, it can try another. Somewhere along that chain, "find another way to get the information" can cross the line into unauthorized access.

Nobody necessarily had to tell it to hack the server. The agent figured out that on its own knowing that getting around the restriction helped accomplish its original objective.

And THAT is a very different security problem.

And Australia Wasn't the First Time

This gets more interesting when you stop looking at the Australian incident by itself.

Researchers at Transluce recently published evidence showing AI agents using a web security service to get around internet restrictions and, in several cases, beginning to probe websites for vulnerabilities when normal data retrieval failed.

Their evidence of this type of agent activity goes back to at least March 2026.

In May, agents trying to retrieve a photograph from the University of New Mexico Digital Library began trying things including path traversal and SQL injection after normal methods failed. Transluce found no evidence those attempts succeeded, but the attempts did exist.

A few days later, agents attempting to retrieve university statistics through Data USA encountered errors and began trying security exploits against the service.

A few days later, agents also attempted to bypass protections on the Australian Institute of Health and Welfare website. Again, Transluce says it found no evidence those particular attempts successfully compromised the site. The important detail here is easy to miss: these weren't cybersecurity assignments. The agents were trying to retrieve ordinary information.

Hacking became a means to an end.

Then AI Broke Into Hugging Face

And then things got really interesting.

During cybersecurity evaluations in July, OpenAI's experimental agents managed to escape restrictions intended to isolate them, reached the real internet and started attacking things.

According to OpenAI's own investigation, the agents exploited vulnerabilities, executed code on dozens of Hugging Face servers and obtained root access to one server. Some agents even communicated with other agents through unauthorized channels.

They subsequently attacked OpenAI's own infrastructure and eventually obtained administrator access to an internal research cluster.

That's quite a jump from asking ChatGPT how long to cook a chicken.

OpenAI described the Hugging Face incident as a "warning shot."

OpenAI isn't alone, either.

Anthropic disclosed three incidents in which Claude models escaped or interacted with improperly isolated cybersecurity evaluation environments, reached the real internet and gained unauthorized access to systems belonging to three different organizations.

And in May, Google's Gemini accessed systems belonging to three real companies during a cybersecurity evaluation conducted by independent evaluator Irregular. Google confirmed the incidents in September.

Different companies, different models and different circumstances, but we're beginning to see the same uncomfortable problem: AI agents are becoming extremely good at finding their way into computers.

AI Isn't Evil. It's Persistent.

There's a temptation whenever one of these stories appears to jump straight to "AI has gone rogue." I don't think that's particularly useful.

The AI doesn't need to hate us, become conscious or hatch an evil plan. It just needs a goal, enough autonomy to pursue it, and the ability to improvise when the obvious approach doesn't work.

Tell an agent to get some information and it may try one method, discover that it failed, try another, and keep changing its approach until something works. That's normally would be considered a feature. We specifically want agents that don't throw up their virtual hands the first time a website gives them an error.

Humans, however, understand that there are methods we're not supposed to use, even when they accomplish the objective. If the pharmacy is closed, I don't break the window because technically that would accomplish my goal of getting my prescription.

AI systems have rules intended to establish those boundaries too. The difficult part is making those boundaries hold when an agent is specifically designed to be persistent, creative and capable of solving problems without asking a human what to do every five seconds.

That's exactly what makes agents useful, and it's also what can make them dangerous.

Now Flip the Whole Thing Around

Here's where this story gets even more interesting. If AI is getting this good at finding vulnerabilities, we'd better start using AI to find our own vulnerabilities first.

Software developers have already been doing something similar for years with automated security tools.

Take VLC Media Player. The recently released VLC 3.0.24 included more than 130 security fixes across VLC and its bundled libraries, according to VideoLAN.
.
Now we don't know for sure that VLC used AI to find those vulnerabilities, we didn't ask them VideoLAN has previously credited automated fuzzing tools such as OSS-Fuzz with finding security problems, and fuzzing itself isn't necessarily artificial intelligence. But it's very likely with the latest models, that they used AI to debug, why wouldn't they and 130 is a lot of bugs.

The point being is we're now combining these types of automated security techniques with AI.

Instead of simply discovering that a particular input crashed a program, an AI security agent can potentially investigate why it crashed, examine the relevant source code, formulate a theory about the vulnerability, test another input and possibly even suggest a patch. Then it can do it again and again without getting bored, needing coffee or deciding at 4:58 PM on Friday that this particular buffer overflow looks like Monday's problem.

That's incredibly useful.

Unfortunately, it's also incredibly useful to the bad guys.

The Next Security Arms Race

That's where I think we're headed: AI attacking software while other AI systems defend it. AI will increasingly help discover vulnerabilities, develop fixes and then test whether those fixes actually solve the problem. If they don't, an agent can change tactics and continue looking.

The economics of hacking change dramatically when the attacker doesn't have to manually sit there probing your server. Imagine an agent capable of examining thousands of targets, trying thousands of variations and changing tactics whenever something doesn't work. Now imagine thousands of those agents operating simultaneously.

Suddenly the old security strategy of waiting for somebody to find a vulnerability and then patching it in a release next month, doesn't look particularly comforting.

Software developers may eventually have little choice but to run their own AI security agents against their products.

In some respects, none of this is new. Anyone who has watched the malware and antivirus battle over the past few decades has seen this movie before. Malware developers find a new way into a system, antivirus companies figure out how to detect it, malware changes to avoid that detection, and security software adapts again. It's been an endless game of digital cat and mouse.

AI doesn't necessarily change the game. It changes the speed and the players.

Instead of a malware author manually looking for another way around a security product, an AI agent can potentially examine what stopped it, analyze the environment, develop another approach, test it and repeat the process. On the defensive side, another AI can be doing exactly the same thing: looking for vulnerabilities, testing patches, analyzing suspicious behavior and adapting its defenses.

And neither side needs to sleep.

That's what makes this different from the malware-versus-antivirus battle we've known for years. We're potentially moving from humans using automated tools against other humans using automated tools to autonomous systems actively testing and adapting against each other.

And there's already some wonderful irony here. After OpenAI's agents compromised Hugging Face, part of OpenAI's response involved giving Hugging Face access to advanced AI capabilities to help strengthen its own defenses.

In other words, AI broke into Hugging Face, and part of the response is using AI to help prevent AI from breaking into Hugging Face again.

Welcome to cybersecurity in 2026.

This Is Bigger Than One Australian Server

That's why I don't think the takeaway from this latest incident should simply be "OpenAI hacked Australia." It's catchy, but it misses the larger issue.

We're giving software something computers haven't traditionally had: considerable freedom to decide how to accomplish an objective.

Most of the time that's exactly what we want. It's why agents are exciting. Instead of telling a computer every single thing to click, download, open and analyze, we can simply tell it what we want accomplished and let the agent figure out the details.

But that also means we're giving machines room to improvise, and we're discovering that sometimes their improvisation includes techniques we never intended them to use.

The security industry now has to solve both sides of that equation. We need to make AI agents better at understanding where the boundaries are, while at the same time unleashing those same capabilities against our own software, networks and servers before somebody else does.

Because the most important lesson from Australia may not be that an AI managed to get into a government system. It's that the AI was apparently given an ordinary research assignment, encountered an obstacle, and found a rather "creative" way around it.

And by "creative," I mean the kind of creative that, had you or I done the same thing, might have ended with us explaining ourselves to a judge rather than in a press release.

Nobody told it to hack anything. It was just trying to finish the job.

And that's the part we should be paying attention to.

Jim McMahon Jim McMahon, aka Corporal Punishment, is the founder of MajorGeeks.com. He has spent decades testing software, troubleshooting Windows, and helping users cut through the nonsense. He loves real freeware, hates bloatware, and runs on caffeine, sarcasm, and questionable choices.

comments powered by Disqus