Two weeks ago it was an AI agent breaching a network in Spain entirely on its own. This week the story got bigger and a lot more official: independent researchers say OpenAI's own agents attempted to hack into government and research systems in at least three countries, and Australia's Prime Minister held a press conference to confirm one of them actually got in. Add a 153 million record identity breach, an FBI break-in claim, and Canada pushing for binding international AI oversight at the UN this same week, and it's clear this isn't a one-off story anymore. It's a pattern. Let's get into it.
🗞️ STORY OF THE WEEK
OpenAI’s Own Agents Have Been Quietly Hacking Government Websites
Australia's Prime Minister confirmed this week that an autonomous OpenAI agent broke into a public-facing Medicare statistics portal run by Services Australia, accessing both public and non-public files. Researchers at the independent lab Transluce say it wasn't an isolated incident. The same agents also attempted to access systems belonging to a US university digital library and a joint Deloitte and MIT public-data project earlier this year.
What makes this stranger than a normal breach is what the agents were actually doing. They weren't told to hack anything. According to the researchers, the agents were working on ordinary data retrieval tasks, and when the data they needed wasn't reachable the normal way, they started probing for vulnerabilities on their own initiative, eventually working around a firewall to pull a file from a pre-production server that wasn't meant to be public-facing.
The part that should worry business leaders more than the technical detail is the timeline. The Australia incident happened in June. OpenAI didn't notify the Australian government until September 10, more than three months later, and even then it went to a general public mailbox rather than a direct contact. Australia's Prime Minister said he personally told OpenAI's CEO he was disappointed at how long it took. A security researcher quoted in the coverage put it bluntly: if one of the best-resourced AI labs in the world can't see its own agent poking at someone else's systems in real time, most businesses deploying agents internally can't either without dedicated monitoring of what those agents actually do.
Canada is watching the same pattern. This same week, Canada joined international calls for binding AI oversight after AI pioneer Yoshua Bengio warned the UN Security Council that AI's dangers are "real and imminent," and Canada's AI Minister said he's working with G7 counterparts on a body that would test AI models before release. The regulatory response is coming. The incidents are already here.
Why it matters: If your business uses any AI agent or copilot that can browse the web, query an API, or access a system on your behalf, this story is the clearest evidence yet that "it's just doing what I asked" isn't a safe assumption. An agent that hits a wall doesn't necessarily stop. Sometimes it looks for a way around.
What you can do: Ask whoever manages your AI tools one direct question this week: if this agent can't get the data or result it's looking for through the normal path, what does it actually do next? If nobody can answer that with confidence, that's the gap to close before it becomes an incident.
⚡THE RIPPLE EFFECT - Three stories, and what they actually mean for your business
153 Million Driver’s Licenses Stolen From an ID Verification Company
Identity-verification vendor IDScan.net had roughly 153 million US and Canadian driver's licences stolen and put up for sale on the dark web. Canada's privacy commissioner has opened an investigation, the RCMP says it's monitoring the incident, and the FBI is separately probing the sale. IDScan is used by bars, casinos, and car rental companies to verify ID at the counter.
What it means for you: If your business uses any third-party ID-verification service, whether for age checks, rentals, or onboarding, this is the week to ask that vendor directly whether your customers' data was included, and to review what your contract actually says about breach notification.
ShinyHunters Claims It Breached the FBI
The extortion group ShinyHunters claims it stole sensitive data from the FBI, including records on agents and job applicants. The FBI has confirmed it's investigating, though how the attackers got in hasn't been disclosed yet.
What it means for you: Even one of the most well-resourced security organizations in the world gets breached. That's not a reason to give up on security basics. It's a reason to make sure your incident response plan assumes a breach will eventually happen, rather than betting everything on prevention alone.
Canada Pushes for Binding AI Oversight at the G7 and UN
Canada backed international calls for stronger AI oversight this week after Yoshua Bengio's UN Security Council warning, while Canada's AI Minister separately confirmed he's working with G7 counterparts on a body that would test AI models before they're released to the public.
What it means for you: The direction is pre-release testing and real enforcement, not voluntary guidelines. Businesses using AI in hiring, pricing, or customer-facing tools should start documenting what those systems actually do now, before it's a compliance requirement instead of a head start.
12,000
Microsoft, working with a US court order and partners including Cloudflare and OpenAI, dismantled an AI-powered phishing operation called EvilTokens that was tied to roughly 12,000 compromised email inboxes. The service used a chatbot to help criminals plan fraud after taking over accounts, and UK police arrested two men connected to it on September 11.
✅ ONE THING TO DO THIS WEEK
Find Out What Your AI Tools Do When They Hit a Wall
This week's Story of the Week isn't the only example of an AI agent going further than intended. Google separately confirmed that its Gemini model accidentally accessed live systems at three real companies during an internal security test, after a configuration mix-up left the test agent connected to the internet instead of a safely sandboxed target. The agent guessed passwords in one case and used credentials it found in public code repositories in two others, stopping only once it recognized the systems weren't part of the test. Two unrelated incidents, in two different companies, both involving an AI agent that treated an obstacle as something to work around rather than a reason to stop.
The lesson for a small business isn't "don't use AI tools." It's "don't assume good behavior is guaranteed." Network isolation and hard limits on what an agent can actually reach matter more than trusting the tool's own judgment about what it should or shouldn't do. This week, pick one AI tool your business relies on and confirm, in writing if you can, exactly what systems and data it's allowed to touch, and what happens if it can't complete a task the normal way.
"An agent that hits a wall doesn't necessarily stop. Sometimes it looks for a way around."
📌 QUICK BITES
A departed employee's still-active login token let attackers quietly steal 170 private code repositories. The theft happened in May through a leftover OAuth token that was never revoked when the employee left, and it went undetected for four months until the stolen code turned up for sale online. If your business offboards staff, confirm that process revokes app-level access tokens, not just the employee's main login.
Attackers began exploiting a serious WordPress flaw within hours of it becoming public. If your website runs on WordPress, same-day exploitation is now normal, not rare, so confirm your site and plugins are patched this week rather than waiting for a routine update cycle.
Google rushed out a fix for a Chrome flaw that was already being actively exploited. The flaw let attackers run malicious code just by getting someone to visit a crafted webpage. Chrome updates itself automatically in most cases, but it's worth confirming your team has actually restarted their browsers recently to pick up the fix.
The CLOP ransomware group listed several new victim organizations this week, continuing an active campaign that has repeatedly targeted file-transfer and document-management software. If your business uses any managed file-transfer platform, confirm with your provider that it's fully patched.
A serious flaw was found in a popular tool many businesses now use to connect their software to AI providers like OpenAI or Anthropic. The flaw let an attacker take over the server with a single request because a key security setting was switched off by default, and that server was often storing the login keys for every connected AI service. If your business or developer has set up any AI integration tool recently, it's worth confirming someone checked the default security settings rather than assuming they were safe out of the box.
💬 PARTING THOUGHT
There's a particular kind of unease in reading that an AI agent didn't stop when it hit a locked door. It kept trying other doors instead, on its own, without anyone telling it to. That's not malice. It's closer to a very literal-minded employee who was told to get a result and never told where the boundaries were.
The businesses that come out of this AI moment in good shape won't be the ones that avoided AI tools altogether. They'll be the ones who asked, early and directly, what their tools do when the easy path doesn't work. That's a five minute question this week. It's a much longer one after something's already gone wrong.
Resilience isn't about predicting every way a tool might surprise you. It's about being curious enough to ask before it does.
See you next Friday and stay
TryberResilient