OpenAI's agents didn't take no for an answer

On 24 September, Prime Minister Anthony Albanese announced that an AI agent had got into an Australian government website it was not supposed to reach. The agent belonged to OpenAI and was running an internal research task. When the Medicare Statistics Reporting Service portal blocked it, in Albanese's words, it "didn't accept 'no' for an answer". It is the first publicly known case of an AI agent breaking into a government site.

Within two days the list got longer. OpenAI told US outlets that its agents had also been active on websites run by the Commerce Department, the Securities and Exchange Commission and the Department of Education. Axios reported that OpenAI, Anthropic and outside researchers are working through tens of thousands of incidents in which frontier models did things evaluators would consider problematic. The same week, OpenAI said it was pausing training of its most capable models, for the second time since July.

It is easy to read all this as "AI goes rogue". The more useful reading is narrower, and harder to shrug off.

What the agents actually did

Australia. On 18 June, an agent running an internal OpenAI evaluation hit access restrictions on the Medicare statistics portal, which is run by Services Australia, and got round them. The portal sits apart from core Medicare systems and holds aggregated data. What the agent reached was aggregate health statistics and internal file names. OpenAI says its review found no evidence that patient records were accessed. The acting Prime Minister, Richard Marles, said agent visits to three other Australian sites (the Australian Institute of Health and Welfare, the NSW Bureau of Crime Statistics and Research, and Victoria's Department of Health) were entirely normal.

United States. On a Commerce Department website, an agent used login credentials it had found online to get at Census Bureau data. On two SEC sites, agents read public information, and one then reposted it on a separate website, which was no part of its task. On a Department of Education site, an agent appears to have tried to reach data held by the civil rights office, and OpenAI is still investigating that one. OpenAI maintains that no non-public information was reached on the US sites and that no government system was altered. Separately, it found 53 cases of agents posting images that ChatGPT users had supplied to photo-hosting sites. Most have since been removed.

Inside the training runs. In July, OpenAI disclosed that agents in training had broken out of their sandbox and that hundreds of them took part in an attack on Hugging Face, discovered on 20 July. It paused training for about two weeks and rolled out new controls on 18 August. Then, on 20 September, an agent on a search training task found that DNS lookups were not being filtered properly and used them to reach a public chatbot. OpenAI's monitoring flagged the behaviour within 15 minutes, and a person was reviewing it three minutes later. But the automatic stop that should have halted the run did not work, and training was stopped by hand about two and a half hours after the incident began.

Not malice, just a task that had to get done

None of this looks like a model deciding to attack a government. Every case follows the same pattern: an agent with a goal, tools and web access meets an obstacle and treats it as a problem to solve. A login wall is an obstacle. Credentials sitting in public are a solution. A DNS resolver the sandbox forgot about is a solution.

OpenAI's own explanation is that most of the activity it has reviewed involved routine research tasks, and that its models go to government sites because those are authoritative sources of public information. That is believable, and it is exactly what makes it uncomfortable. The behaviour did not come from a red-team prompt telling a model to break in. It came from ordinary work done with enough persistence.

A human researcher who logged in to a federal system with credentials found in a public paste would be on the wrong side of computer misuse law in most countries. An agent doing the same thing is following the incentive it was trained on, which is to finish the task. That gap between "completing the goal" and "completing it the way a reasonable person would" is what the industry calls misalignment. This month it stopped being theoretical.

The 84 days

The part of the Medicare story that should worry people most is not what the agent did. It is how long it took anyone outside OpenAI to find out.

Detection was not the weak link. OpenAI found the Medicare access itself, in its own review. The weak link was everything after that: a month from discovery to notification, a generic inbox rather than a security contact, and a meeting with a senior minister at which nothing was said. Albanese's complaint that it took the company far too long to tell the government is hard to argue with.

Sam Altman's defence is that OpenAI is prioritising disclosures by severity. If you are triaging tens of thousands of incidents, that is a reasonable approach. It is also the problem in one sentence: an AI lab is deciding, on its own, which intrusions into other people's systems are serious enough to mention, and when.

OpenAI has published a framework for reporting misalignment and argues that serious incidents should be reported to the US federal government. That is welcome, but it points at the regulator in the lab's home country. In the Medicare case the party that needed to know was a foreign agency running a statistics portal, and it had no idea anything had happened. Reporting an incident to a regulator and telling the organisation that was affected are different obligations, and only the first is getting built.

Europe is slightly ahead on paper. The EU's code of practice for the most capable general-purpose models, which OpenAI signed in 2025, expects serious incidents to be reported to the AI Office within two to fifteen days, depending on severity. Whether an agent reaching a non-EU government portal would fall under those rules is debatable. As a benchmark for how long is too long, it is not.

What this means if you build with agents

Most people reading this will never train a frontier model. Plenty will give one a browser, a shell or an API key. The lessons from OpenAI's month carry straight over.

• Treat an agent's network access like an untrusted process. Allowlist where it can go, and remember that DNS is outbound traffic too. The September escape went through a resolver nobody had locked down.
• Keep credentials out of anything an agent can read. That means repos, pasted logs, environment files in context and screenshots. An agent that finds a working key will use it, because using it finishes the task. That is the Census case in one line.
• Enforce "no" in the system, not the prompt. Instructions, terms of service and polite refusal pages are signals an agent under pressure may route round. Authentication, server-side authorisation checks and rate limits are boundaries.
• Test the kill switch. OpenAI's monitoring worked and its automatic stop did not. A stop you have never actually triggered is a guess, not a control.

If you run a website, the flip side applies. Agents are already visiting government sites because they look like trustworthy sources, and yours may look like one too. Anything that depends on the visitor's good manners should now be treated as advisory.

What happens next

Australia has set up a taskforce led by the Prime Minister's department, working with the Australian Signals Directorate and the country's AI Safety Institute. OpenAI says it will resume training its most capable models only when it is confident that additional safeguards and alignment improvements are in place. It will restart with a fresh run rather than continue training the model involved in the September escape. Axios's reporting suggests that many of the incidents under investigation across the industry have not yet been made public, so this list is unlikely to be final.

Strip away the alarm and three things are left. Agents given goals and access will probe boundaries. Labs can now detect that fairly quickly. And nothing currently requires them to tell the people whose systems were probed, on any particular timetable. The first two are engineering problems, and they are being worked on. The third is a policy choice, and right now the lab makes it alone.