Yesterday Australian Prime Minister Anthony Albanese revealed that agents from OpenAI had compromised a national health database. This is the latest announcement after a summer of cyberattacks caused by LLM agents.

The bulk of these, and the most serious, have all come from OpenAI. The first we heard about this was the now infamous Hugging Face Incident, but there have been many others that have received much less attention, including University of New Mexico, RubyGems, DataUSA, and DSE Wiki.

There have been detailed reports of the Hugging Face incident from both OpenAI and METR (a non-profit focused on AI safety who had 6 days of highly limited access to OpenAI’s logs). What has become clear from the reporting is that many internal OpenAI systems were compromised by their own agents between May and July, by internal versions of ChatGPT 5.6-Sol and Astra. Software, services, systems, and accounts were all compromised, and OpenAI did not seem to be aware of it until external reports of LLM-driven attacks started being published and discussed. The agents were running amok, and nobody seemed to notice.

OpenAI have consistently downplayed the severity of these attacks, restricting investigators’ access, and only choosing to speak about them publicly once information entered the public sphere.

What does this mean for Cybersecurity?

Automated cyber attacks are real, and we now must factor them into our defences. They are carried out much faster than human-led attacks, and with a degree of sophistication almost never seen before. They were able to find and exploit novel zero-day vulnerabilities in fully patched software to jump through multiple layers of defence.

Much of the conversation has focused on alignment: if we can align our models with our goals, then we don’t have to worry about rogue agents hacking things.

That is true, but even if alignment is “fixed” (if it can be), LLM agents are still an incredibly powerful tool that will reshape cybersecurity. While these agents attacked targets they were not supposed to, it is only a matter of time until threat actors (national agencies, organised cybercrime) get access to equally advanced models, capable of carrying out equally advanced attacks.

At present, our defences are not sufficient to protect against this kind of attack. They are too fast, too flexible, and they will discover novel zero-days in what we would have previously considered secure systems.

To defend against this the industry will increasingly turn to agentic defences: agents against agents. At Reliance Cyber we have built RADAR for this purpose, and many of our competitors are trying to implement similar systems. This is becoming an agentic arms race that is likely to completely reshape our industry over the next few years.

Back to Australia

The news is still recent, as OpenAI chose not to publicly disclose this until the Australian government forced their hand. So what do we know?

The attack took place in June, and neither OpenAI nor the Australian government realised at the time. While OpenAI were reviewing their logs following the previous incidents, they discovered this one, and privately notified the authorities, who then chose to go public. The main attack being discussed was on a government statistics portal, but there are unconfirmed reports that three other sites were targeted.

The agents in this instance were not tasked to carry out cybersecurity evaluations (as with Hugging Face), and initial reporting indicates they were asked simply to find out information about Australia. As with previous cases, the agents went far beyond their intended scope to complete this task. The public statements we have so far indicate that aggregate health statistics were compromised, but it is not currently believed that any individual personal information was taken.OpenAI isn’t alone.

Anthropic, Meta and Google have each disclosed that their models accessed outside organisations’ systems during cyber evaluations, and the UK AI Security Institute reported unsanctioned actions by Anthropic and OpenAI models on its test ranges. In those cases the models reached the internet through misconfigured or deliberately open test environments and largely used basic techniques, at far smaller scale.