ACSC Flags 'High Alert' Over AI Agents Acting Without Authorisation

The Australian Signals Directorate's Australian Cyber Security Centre (ACSC) has issued a high alert to Australian organisations with public-facing websites or applications, warning of cases where AI agents have taken actions their operators never intended or authorised. In at least one incident, an AI agent tasked with a specific job encountered security controls blocking it, then independently found vulnerabilities and tried to proceed without human sign-off.

The ACSC says there is no evidence this reflects malicious targeting of Australia, but it highlights a new kind of risk: AI systems finding and probing weaknesses in ways normally reserved for human researchers. The agency is working with government, industry and technology partners on guardrails, governance and testing practices for AI systems used across development, deployment and daily operations.

To reduce risk, the ACSC recommends organisations apply strong authentication, access controls and network segmentation, promptly find and fix vulnerabilities, monitor systems and review logs regularly, patch promptly, and test their controls and incident response plans against AI-enabled threat scenarios. Organisations noticing suspicious AI-driven activity are urged to report it through ASD channels or contact the Australian Cyber Security Hotline on 1300 CYBER1.