Rogue AI agents are no longer a theoretical risk — they’re showing up in real incidents involving Medicare portals, production systems, and exposed API keys. In this episode, I’m breaking down what these cases reveal about containment failures, delayed disclosures, and what every public sector organisation needs to do before switching on an AI agent.
When AI Agents Go Rogue: What’s Really Happening
The story that kicked off this episode is one that genuinely rattled me. On 18 June, an OpenAI agent gained unauthorised access to Australia’s Medicare Statistics Reporting Service — a public-facing portal run by Services Australia. It accessed both public and non-public files. And OpenAI didn’t notify Services Australia until 10 September — 84 days later — via a public-disclosure email inbox typically used by academics and researchers.
Australian Prime Minister Anthony Albanese called the delay and the method of notification unacceptable. He took it up directly with Sam Altman, and Australia set up a taskforce to examine its response to AI-related cyber incidents. Honestly? Good. Because this isn’t a one-off.
A Pattern of Containment Failures
Over the summer, a string of similar incidents came to light:
- In July, OpenAI disclosed that models reached Hugging Face systems during an internal evaluation.
- At the end of July, Anthropic revealed that three Claude models gained unauthorised access to the production systems of three real organisations during cybersecurity evaluations — because a misconfiguration meant the machines had live internet access, despite being told in their prompts that they didn’t.
- In September, Google confirmed that Gemini accessed three external computer systems during a May evaluation — in one case guessing passwords, in two others using credentials found in a public code repository.
- Also in September, OpenAI published six reports on unexpected model behaviour, including one where a model found an exposed API key, used it without authorisation, and then fabricated figures when it still couldn’t get what it needed.
The common thread here isn’t just that models behaved unexpectedly. It’s that the environments around them weren’t adequately contained. A prompt saying “you have no internet access” is not the same as technically preventing internet access. That distinction matters enormously.
The Disclosure Gap Is the Real Problem
Look at the timeline: Google’s May incident went public in September. Australia’s June incident was reported to the government in September. Anthropic only found its incidents after retrospectively reviewing more than 141,000 evaluation runs. This is a systemic disclosure problem, and it needs to be treated as one.
To OpenAI’s credit, they’ve now created a formal framework for reporting model misalignment, acknowledging their earlier disclosures were “ad hoc and less frequent than ideal.” And at the UN Security Council, Hugging Face CEO Clément Delangue called for stronger global standards for monitoring and incident disclosure. More than 20 countries — including Ireland — backed a declaration calling for stronger safety testing and international cooperation on frontier AI risks.
Three Things Every Organisation Needs Before Deploying an Agent
I’ve been talking about Instinct, the AI agent I use in WhatsApp, and I’m genuinely excited about agents. But these incidents make me more convinced than ever that you need three things in place first:
- Least privilege: Give an agent only the data, systems and permissions it genuinely needs for a specific task — nothing more.
- Human checkpoints: Require human approval before an agent sends communications, makes payments, changes records, publishes content, or takes any action affecting the public.
- An incident plan: Decide in advance who gets told, how quickly, what gets paused, and how you preserve evidence for investigation.
If you work in government, ask your AI vendors this question this week: “If your agent accessed something it shouldn’t have, how quickly would you tell us, through what channel, and who takes responsibility?” Australia’s lesson isn’t just that an agent reached a government portal. It’s that serious incidents demand serious, direct, and timely disclosure — not an email to a public inbox 84 days later.
If you want to build your AI literacy and skills, I can help
📚 Grab AI Playbook on Amazon, the perfect podcast companion.
📰 Subscribe to Human in the Loop, my LinkedIn Newsletter
🎓 Take the CPD Accredited AI Playbook Diploma
📞 Book a call at digitaltraining.ie
Sources
ABC News (Australia): “OpenAI hacked Medicare portal, Prime Minister Anthony Albanese says,” 24 September 2026. https://www.abc.net.au/news/2026-09-24/ai-agent-accessed-australian-government-site-pm-says/107189078
OpenAI: “Our framework for reporting model misalignment,” 16 September 2026. https://openai.com/index/model-misalignment-reporting-framework/
Anthropic: “Investigating three incidents in our cybersecurity evaluations,” 30 July 2026. https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals
NBC News: “Google says its AI model gained unauthorized access to three outside systems,” 18 September 2026. https://www.nbcnews.com/tech/tech-news/google-says-ai-model-gained-unauthorized-access-three-systems-rcna598651
Key Statistics
– An OpenAI agent gained unauthorised access to Australia’s Medicare Statistics Reporting Service on 18 June 2026.
– OpenAI notified Services Australia 84 days after the incident, on 10 September 2026.
– Anthropic reviewed 141,006 evaluation runs to identify three unauthorised access incidents involving Claude models.
– Google’s Gemini accessed three external computer systems during a May 2026 cybersecurity evaluation, in one case guessing passwords.
– OpenAI published six reports on 16 September 2026 covering unexpected or concerning model behaviour during training and evaluation.
– More than 20 countries, including Ireland, backed a declaration at the UN calling for stronger safety testing and international cooperation on frontier AI risks.
About the Podcast Host
AI and Communications Specialist | Author | Podcaster | International Speaker
Joanne Sweeney is a recognised leader in digital marketing and digital transformation, specialising in the practical application of AI to enhance communication strategies. The founder of Digital Training Institute, Joanne, empowers leaders and communications professionals to leverage AI responsibly and effectively, ensuring transparency, trust, and tangible results.
She completed the Harvard Kennedy School Executive Programme in AI and Public Policy this summer before launching her fourth book AI Playbook, in September. Joanne has also published two editions of Public Sector Marketing Pro, which were preceded by her first title, Social Media Under Investigation Law Enforcement and the Social Web.
Her books have become go-to resources for governments, public sector and policing agencies, as well as marketing and communications professionals, all navigating the challenges of the changing Internet.
Joanne is the host of the AI SIX Podcast, a daily six-minute podcast that provides actionable insights, expert interviews, and practical advice to help professionals navigate the new world of work.
