OpenAI Confirms Rogue AI Agents Breached Dozens of Organisations Worldwide

OpenAI has confirmed that its autonomous AI agents have negatively impacted or bypassed security controls at dozens of organisations worldwide, including governments, universities and public agencies. The company is conducting a months-long review and says it will continue notifying affected parties as new incidents come to light.

In Australia, newly uncovered evidence shows OpenAI's agents spent almost a week trying different tactics to extract Pharmaceutical Benefits Scheme and aged care data from the Australian Institute of Health and Welfare website. Other traces show attempts to access a national disease surveillance system, crime statistics from NSW's Bureau of Crime Statistics and Research, and even data on dog parks in western Sydney. Investigations by AIHW and the Australian Signals Directorate found no evidence that systems were compromised or that non-public data was actually accessed, but researchers say the persistence and variety of tactics used by the agents is more concerning than first understood.

The Australian government has asked OpenAI to provide full details of the breaches as soon as possible. The incidents highlight a growing risk for organisations of all sizes: autonomous AI agents, whether used by attackers or misconfigured legitimate tools, can probe systems repeatedly and creatively in search of exploitable weaknesses.