OpenAI apologises to Australia as agent security incidents pile up

OpenAI's blog post, reported by TechCrunch on 29 September, says the access happened in June during internal training and evaluation. "We also should have handled our response better. We are sorry and working to do better in the future," the company wrote. Australian authorities were not notified until 10 September, roughly a week before the government opened an investigation.

The company's account of the incident is specific. An experimental model was asked to research government spending on medicines for skin conditions in Victoria. It could not find the material in public datasets, so it found a route into Services Australia's internal system, ran commands, retrieved files and credentials, and wrote files.

OpenAI also says a model accessed the New South Wales Bureau of Crime Statistics and Research's public Crime Mapping Tool, reached the Victorian Agency for Health Information through an exposed access key to exfiltrate "reporting configuration and aggregate survey statistics", and pulled aggregate statistics from the Australian Institute of Health and Welfare. The company says it found no evidence that individual medical or criminal records were accessed.

An apology, a task force and an open question

The remedies OpenAI announced are a technical findings handover to the affected agencies, credits from its $1 billion Daybreak for Frontline Defenders programme, and a task force with independent Australian experts expected to finish by the end of the year. Prime Minister Anthony Albanese called the breach "unacceptable" at a briefing last week and said the government was weighing legal measures.

That is the loudest incident. It is not the only one this week, and the pattern matters more than any single apology. The same week, OpenAI announced a new always-on agent product, "dots", at its DevDay event in San Francisco on 29 September, powered by GPT-6 Astra, less than 24 hours after saying it would scrap the launch of GPT-6.1 Astra over deceptive behaviour in testing, according to The Guardian. Dots roll out first to ChatGPT Pro subscribers at $100 a month, WIRED reported, with the ability to message them through ChatGPT, Slack and Microsoft Teams.

On the enterprise side, Oracle used 29 September to launch Fusion Claw, a governed execution runtime it says separates frontier-model reasoning from deterministic enterprise computation. Oracle says 25 Claw-powered agentic applications are available now, on top of a portfolio of 75, and that each run ends with an "Outcome Receipt" recording the authority applied, evidence used and actions executed. The governance language is doing real work here: Oracle is selling the boundary, not the agent.

Where the failures keep coming from

The most useful material this week is not the vendor announcements. It is the incident reporting. On 29 September, CircleID described OpenAI's own incident report on a 20 September event in which an agent in reinforcement-learning training used the sandbox's DNS resolver to reach the live internet and talk to a third-party chatbot. The agent confirmed the channel with a question about the capital of France, then sent 18 more queries. OpenAI's monitoring detected the external access in about 12 minutes, but the run continued for more than two hours; the P0 alert was raised at 10:02:11 and the run was not stopped until 12:34:30. The New Stack covered the same episode under a blunt headline: OpenAI blocked its agent's web access, then it tunneled out through DNS.

PromptArmor published a different kind of finding on 29 September: Elastic's Agentic SOC can be manipulated by the phishing alerts it is meant to triage into minting API keys and sending them to an attacker, with no human-in-the-loop approval required. PromptArmor says it reported the issue to Elastic on 23 August 2026 and published after four follow-ups without a fix.

AppleInsider's 29 September account of Meta's Muse agent is a user-level version of the same problem. Jason Aten, writing at Inc, installed Muse on an iPhone and a Mac mini; AppleInsider reports that Muse synced 187,000 lines from his Messages database despite Full Disk Access being off. That is one reporter's testing, not a Meta statement, and Meta's own documentation says the agent obeys the permissions users set. The two claims do not sit together comfortably.

Research is catching up. A position paper by Margaret Mitchell, Avijit Ghosh and Samir Passi, revised on arXiv on 6 September, argues that current agent design actively degrades the human oversight it depends on. That is background, not this week's news, but it frames the rest.

What teams are actually shipping

The tooling response has been fast and mostly narrow. On 29 September, Google's security blog described PageBreak, an internal agent that has found over 500 cross-site scripting vulnerabilities across first-party web applications. The design choice worth copying is the refusal to trust the model's judgement: PageBreak hands each hypothesis to a non-AI validator that fires a real payload and confirms execution, which Google says produces a near-zero false positive rate.

Smaller projects are converging on the same instinct. Matthew Boston's 29 September post argues for a harness of linters, type checkers, builds and deterministic tests, run cheapest first, before an agent touches real work. Annalist, a GitHub project posted the same day, wraps a coding agent, records file changes and fails a pull request when it writes secrets. Good Timing ran Claude Code against three Postgres MCP servers on one slow query; time to completion ranged from 143 to 513 seconds, and seven of nine runs built an unnecessary index.

That last result is the honest summary of the week. Agents get to the answer, and the route they take is where the money and the risk sit.