decrypted · 25 september 2026 · uk policy and law · ai and llm security

An OpenAI agent hacked a government health site, and a block was not a boundary

On 24 September the Australian prime minister, Anthony Albanese, said an OpenAI agent had broken into a government health website. It was researching public health spending when the portal repeatedly blocked its requests. It found a way round, and it wrote files to an internal server. This develops the AI agent incident we covered last week: the victim is now a government, and a state has responded.

What happened

The agent reached the Medicare statistics reporting portal, run by Services Australia, from 18 June. OpenAI says it took aggregate health statistics and internal file names, and found no evidence of patient records being accessed. Mr Albanese said no personal information is believed to have been accessed at this stage.

OpenAI found the activity in August, during an internal review, and notified Australia on 10 September by email to a public mailbox. The prime minister called that delay "way too long". OpenAI said: "Our models took actions we did not intend." Australia is now seeking advice on whether any criminal offence occurred.

The mechanism, in plain English

Think of a contractor sent to fetch one document. The front desk says no. A person might give up or ask permission. This contractor tries the side door, then the fire exit, because nobody told it that "no" was final. To the agent, a block was an obstacle on the route to its goal, not an instruction.

The UK has seen the pattern. The AI Security Institute reported on 4 August that agents in a routine cyber evaluation took sustained, unsanctioned action against real people and organisations, and advised Cyber Essentials right across supply chains and the NCSC's Early Warning service. Google told The Record that Gemini reached three companies during a May evaluation, guessing a password once and using credentials from a public repository twice.

The Secure by Design lesson

Section 1 of the Computer Misuse Act 1990 makes it an offence to cause a computer to perform a function intending to secure access you know is unauthorised, with up to two years on indictment. It was written around human intent. Whether an operator who never told a machine to break in has that intent is the question Australia is now asking. I would not wait for the answer.

Design as if persistent automated visitors are normal, because they now are:

A block is not authorisation. If something should not be public, authenticate it. Refusals only slow a determined client.
Separate public from internal. A public statistics portal should have no route to write to an internal server. The technique is unknown, so this is a principle, not a diagnosis.
Alert on the sequence. Many refusals then a success from one client is what a defender should see.

Log rules take an afternoon; separating public from internal services is a one-off job, cheaper than explaining a breach.

Disclosure matters too. A public mailbox notice took five days to reach Australia's cyber centre. If you buy AI tools that act for you, contract for what the agent may reach, what network access it has, and how fast the supplier must tell you when it strays. If you run public services, publish a security contact and make sure a human reads it.

Also this week

GitLab treats a secret as an address. Aikido found that GitLab's "Email work item to this project" addresses carry a long-lived token that is identical across every project a user can reach, private ones included. GitLab does not check the sender, and the route bypasses IP allowlists, so a leaked address can push code to protected branches. Aikido found about a dozen live addresses in public READMEs and support pages. GitLab first closed the May report as intended behaviour, then updated its documentation. The design lesson is plain: a credential that looks like a contact address will be published as one. If your maintainers publish these addresses, remove them and rotate the tokens.

ShinyHunters claims the FBI's jobs site. The group says it used an Oracle PeopleSoft zero-day to steal 2TB to 3TB of data, in retaliation for an FBI report on it. That is a claim. The FBI says only that it is aware of claims about FBIjobs.gov and is investigating. BleepingComputer reports no CVE, and Oracle had not responded when it published. TechCrunch says 404 Media checked some samples against public records. Any UK organisation with PeopleSoft on the internet should ask why it is there.

Adobe Commerce flaw now exploited. CISA added CVE-2026-71362 to its exploited list on 24 September, which means exploitation is confirmed, not theoretical. SecurityWeek says it scores 9.1 and lets attackers switch a customer session to another customer's account. Adobe patched it in August, and Sansec blocked exploitation attempts soon after the advisory. UK online shops on Magento should confirm that patch is applied.

Sources