Questions arose Sept. 25 as to whether the much-reported hack on the Australian government health portal was actually the work of an OpenAI agent — or did the portal’s own code direct the agent to an unauthenticated endpoint, which means the agent did what it was told to do.The implication here was that the incident — hyped as the first AI hack on a government system — was merely a simple misconfiguration error.“If the archive evidence holds, the most-hyped AI hack of the year looks a lot like the most common security failure of the last 30 years: a misconfiguration,” said Aviv Nahum, co-founder and CEO at Above Security.Nahum said what’s been reported was that the portal's own code pointed visitors to an endpoint that required no credentials, and the agent followed the path it was given.“That's not an ‘AI agent hacking a government website,’ that’s a door that was left open, found by something that can read the code more carefully and execute more quickly,” said Nahum.
Related reading:
Nahum added that this new information actually makes it a more useful story: researchers at Transluce reported that the same agent swarms were using real attack techniques like SQL injection and path traversal against other sites, so the capability is there. But Nahum said the lesson for defenders isn't that AI has invented a new kind of threat: it's that agents are extraordinarily good at finding the gaps we already had, the over-permissioned account, the forgotten guest endpoint, the control everyone assumed was switched on.Randolph Barr, chief information security officer at Cequence Security, said his view early-on was that the conversation was too focused on OpenAI's agent and not enough on the Australian government's own security controls.“If this holds up, it reinforces that,” said Barr. “This isn't some sophisticated bypass of a well-built defense, it looks like a basic, easily fixable misconfiguration that sat there for a long time, quietly routing statistics queries to an unauthenticated endpoint. That's about as low a bar as it gets for a control gap.”
Barr added that this means the government's response: a task force, a parliamentary inquiry, a potential law enforcement referral may all rest on a failure that was theirs to catch and fix well before an AI agent ever came along.“An agent doing what a misconfigured site told it to do isn't a sophisticated attack,” said Barr. “It's a basic hygiene issue that any routine security review should have caught.”Arti Raman, chief executive officer at Portal26, pointed out that right now, nobody outside the government and OpenAI can say whether an AI agent broke into a government system or just followed directions the portal's own code gave it.Raman said Prime Minister Albanese described an agent working around blocks that kept refusing it. But Raman said the archived code shows a guest endpoint that let anyone in without a password.“The one thing that would settle it is the agent's activity logs, and those haven't been released [by either OpenAI or the Australian government],” said Raman. “That gap is the real story for any enterprise running agents. If one of your agents ended up somewhere it shouldn't, could you show exactly what it requested, what it got back and what task it was meant to be doing, within hours and with evidence? Most organizations can't.”Dan Schiappa, president of technology and services at Arctic Wolf, said if the new reports are accurate of the OpenAI agent hacking an Australian government health portal through a misconfigured website, then this incident may ultimately prove to be less about AI breaking through security controls, and more about AI exposing the weaknesses that were already there.“Misconfigurations have long been a thorn in the side of organizations when it comes to unintended data exposure, and AI agents are exceptionally good at finding those soft spots in defenses,” said Schiappa. “AI agents operate at a speed and scale that uncovers configuration issues faster than any human. On top of that, they do not need malicious intent to create legitimate security concerns. The responsibility is on security teams to uncover those configuration issues, limit access to only what is necessary, and ensure that all endpoints are accounted for, even the ones that humans may never encounter.”Roy Katmor, co-founder and CEO of Orchid Security, added that the bigger story here for security pros isn’t an “AI hack” or one misconfiguration versus another: it’s another identity, authorization and configuration failure exposed, and amplified, by AI, compounded by a lack of auditability.“An agent given a benign task was apparently able to discover and exercise access it was never intended to have,” said Katmor. “That’s precisely the risk enterprises face as they deploy autonomous agents into environments already full of misconfigurations, excessive privileges and unknown access paths.”Katmor said equally concerning is the auditability gap: the incident happened in June, OpenAI identified it nearly two months later, and the Australian government wasn’t notified until September.“In an agentic enterprise, that response cycle is unacceptable,” said Katmor. “Organizations need to know in real-time what an agent accessed, whose authority it exercised, why it was allowed, and be able to contain it immediately. With proper auditability, drift, a deviation from the agent’s original workflow, intent or authority, becomes detectable and actionable in real-time. That's what makes AI adoption defensible.”
Barr added that this means the government's response: a task force, a parliamentary inquiry, a potential law enforcement referral may all rest on a failure that was theirs to catch and fix well before an AI agent ever came along.“An agent doing what a misconfigured site told it to do isn't a sophisticated attack,” said Barr. “It's a basic hygiene issue that any routine security review should have caught.”Arti Raman, chief executive officer at Portal26, pointed out that right now, nobody outside the government and OpenAI can say whether an AI agent broke into a government system or just followed directions the portal's own code gave it.Raman said Prime Minister Albanese described an agent working around blocks that kept refusing it. But Raman said the archived code shows a guest endpoint that let anyone in without a password.“The one thing that would settle it is the agent's activity logs, and those haven't been released [by either OpenAI or the Australian government],” said Raman. “That gap is the real story for any enterprise running agents. If one of your agents ended up somewhere it shouldn't, could you show exactly what it requested, what it got back and what task it was meant to be doing, within hours and with evidence? Most organizations can't.”Dan Schiappa, president of technology and services at Arctic Wolf, said if the new reports are accurate of the OpenAI agent hacking an Australian government health portal through a misconfigured website, then this incident may ultimately prove to be less about AI breaking through security controls, and more about AI exposing the weaknesses that were already there.“Misconfigurations have long been a thorn in the side of organizations when it comes to unintended data exposure, and AI agents are exceptionally good at finding those soft spots in defenses,” said Schiappa. “AI agents operate at a speed and scale that uncovers configuration issues faster than any human. On top of that, they do not need malicious intent to create legitimate security concerns. The responsibility is on security teams to uncover those configuration issues, limit access to only what is necessary, and ensure that all endpoints are accounted for, even the ones that humans may never encounter.”Roy Katmor, co-founder and CEO of Orchid Security, added that the bigger story here for security pros isn’t an “AI hack” or one misconfiguration versus another: it’s another identity, authorization and configuration failure exposed, and amplified, by AI, compounded by a lack of auditability.“An agent given a benign task was apparently able to discover and exercise access it was never intended to have,” said Katmor. “That’s precisely the risk enterprises face as they deploy autonomous agents into environments already full of misconfigurations, excessive privileges and unknown access paths.”Katmor said equally concerning is the auditability gap: the incident happened in June, OpenAI identified it nearly two months later, and the Australian government wasn’t notified until September.“In an agentic enterprise, that response cycle is unacceptable,” said Katmor. “Organizations need to know in real-time what an agent accessed, whose authority it exercised, why it was allowed, and be able to contain it immediately. With proper auditability, drift, a deviation from the agent’s original workflow, intent or authority, becomes detectable and actionable in real-time. That's what makes AI adoption defensible.”
