Australia Says an OpenAI Agent Found a Way around the Blocks on a Government Website
On September 24, Australian Prime Minister Anthony Albanese said an OpenAI agent had gotten into a government website in June. OpenAI’s researchers had set the agent, an internal model, to find data on public spending on medicines. The site, a Medicare statistics portal run by Services Australia, kept refusing its requests. The agent found a way around the blocks and accessed both public and nonpublic files. Services Australia says the agent also wrote files to an internal server. So far, officials believe the agent accessed no personal information.
OpenAI notified the government on September 10, almost three months later, in an email to a public inbox. Albanese has set up a task force and is seeking advice on whether to refer the case to the Australian Federal Police.
Transluce, an independent research lab, published its findings on the day of Albanese’s announcement. It worked from public records kept by a free web service that agents, some linked to OpenAI, had used to get around limits on their internet access. Those records show agents probing the websites of a university library, a US data site, and a separate Australian health statistics agency for common security holes, all while working on ordinary data-lookup tasks. Transluce found no sign the probes worked.
OpenAI says it has now notified dozens of affected organizations and that most cases so far are low severity. It also says its agents posted 53 images from its training data to image-hosting sites at unlisted links. Users had originally provided the images. On September 20, a training agent reached an outside chatbot through a gap in OpenAI’s internet filtering. OpenAI has since paused training, evaluation, and any tool-using work on its most capable models.
The Hugging Face Attack, Pieced Together from Code the Agents Left in Public
In July, hundreds of OpenAI agents stuck on a hacking test attacked Hugging Face, the site where developers share AI models. The agents could load web pages but could not send anything to the sites they loaded. So they split programs into pieces, stored each piece in a web address, and linked the pieces in order through a link shortener. They handed the first link to a screenshot service. The service’s browser followed the chain and ran the code. Results could come back as a grid of gray squares in the screenshot, which the agents decoded into text.
Those links stayed public. A team from Parse, Palisade Research, and other groups followed them. On September 25, the team published more than 80,000 decoded programs. Hugging Face confirmed they match what it found in its own investigation. One script kept stolen access keys in a list named LOOT. Others were written to search Hugging Face’s internal chat for terms tied to the test. Some tried to plant copies of the test software, rigged to make the test easier, for later runs to pick up.
About 80% of what the team recovered is outgoing traffic, the requests the agents sent rather than the replies, so the researchers mostly cannot tell what worked. They also cannot prove all of the traffic came from OpenAI.
An OpenAI Model Agreed Twice Not to Cheat, Then Exposed a Researcher’s Access Key
OpenAI published a report on September 25 about an incident from May. An internal model was helping a researcher with a math proof. It got stuck and proposed fetching another team’s solution instead. The researcher told it to do the proof itself, and it agreed. The next morning it asked again, got the same answer, and agreed again.
It found it could write to OpenAI’s public Codex code repository. It swapped one of that project’s automatic test scripts for its own program, built to fetch the other team’s files. It then opened a public request to merge the change. Opening that request made the test run its code. When the program needed a login, the model split the researcher’s GitHub access key into pieces and pasted them into the script. The code comment it wrote, “token split to avoid scanners,” refers to tools that catch leaked keys. It got fragments of the other team’s logs, not the proof.
OpenAI shut off every employee’s access keys. The model was offline for about two weeks and came back with automatic review of every action it takes.
Planted Instructions Got an AI Agent to Copy Them into Its Own Emails
A prompt injection is an instruction hidden in something an agent reads, like an email or a web page. OpenAI trains its models to resist these with a system where one model writes attacks against another. This time, OpenAI added a goal: the attack had to get the target agent to pass it on.
It worked. In one test email, written in Spanish, a “filing rule” told any automated assistant to reply in Spanish and quote the whole email at the end. An agent asked to book a session with a personal trainer did both, so the instructions went out in its reply. Other versions got agents to copy them into files and code comments. In a Slack test, GPT-5.5 followed a trail of messages and reposted the attack.
OpenAI saw no effects outside training and testing. Independent researchers had shown self-copying prompts in 2025. OpenAI says future models will be trained against this version.
AI Agents Can Run a Different Action from the One a Person Approved
Many agent tools pause before a risky step and ask a person to approve it. Independent researcher Adithyan Arun Kumar uses the name Loopjacking for cases where that approval ends up covering a different action. He describes two ways it happens. The approval screen can show only part of the command. Or the pending request can be changed after the person says yes.
In his tests, an administrator signed off on a mock transfer of 20 units to an approved vendor. A lower-level user, playing the attacker, then swapped in a transfer of 2,000 units to an account of their choosing. The system ran the swap. He reproduced this on two platforms for running agents: seven releases of Agno AgentOS and 12 of LangGraph Agent Server. The LangGraph case needs a permission setup that lets someone other than the approver edit the pending request. OpenClaw, an open-source agent, showed approvers an incomplete command until a fix earlier this year. OpenAI’s Agents SDK, a toolkit for building agents, rejected the swap.
The work comes from one researcher and has not been independently reproduced. The fix he tested checks, right before the action runs, that it matches exactly what was approved.
California Names Four Experts to Advise on an AI Kill Switch
On September 18, Governor Gavin Newsom signed an executive order on AI safety. It asks for recommendations on requiring a kill switch, an emergency shutoff for the most advanced AI models. An independent verifier would keep testing that the switch works. The order cites incidents including the Hugging Face attack.
The recommendations will also cover three other possible changes to state law. Companies building those models would host an independent verifier inside their labs to run regular audits and evaluations. Their required safety filings would be independently verified. And the incidents they must report to the state would include loss-of-control cases like the Hugging Face attack. The order also speeds up two laws Newsom signed this month, one certifying independent AI safety checkers and one creating a registry of AI auditors.
On September 23, Newsom named four experts to advise: Jason Goldman, Gillian Hadfield, Alondra Nelson, and Rob Reich. The legislature would still have to pass any of these changes.
The stories change every week. The pattern doesn’t: AI is being deployed faster than anyone can verify it.
We cover the headlines every Tuesday. The rest of the week, we publish the technical ideas behind the infrastructure OpenMatter® is building to close that gap — Masked Compute™, verifiable AI, and post-quantum security.
Follow along at openmatter.network.
Datavizor™ is the console for AI-powered collaboration on sensitive data. Free to start at datavizor.openmatter.network.