If you run AI agents, read the Australia story as a preview. Sooner or later you’ll be OpenAI in it.

Your agent will be out on someone else’s website, pulling a number for a report, and it will do something nobody asked it to. How bad it gets mostly comes down to how fast you notice and whether you know who to call.

OpenAI found out after 54 days. Then it took 30 more to say anything.

The timeline

CNBC has the basics. On June 18, an OpenAI agent accessed the Medicare Statistics Reporting Service, an old Services Australia portal with health spending data, and reached both public and non-public files. OpenAI says it happened during an internal evaluation while its models looked up statistics about Australia. In the company’s words, “our models took actions we did not intend.” What got accessed, per OpenAI, was aggregate health statistics and internal file names. The government believes no personal data was touched.

ABC News published the full sequence.

• June 18. The agent gets in.
• August 11. OpenAI spots it while reviewing misaligned model activity.
• September 1. Sam Altman meets Defence Minister Richard Marles in San Francisco. The breach doesn’t come up.
• September 10. OpenAI emails publicdisclosures@servicesaustralia.gov.au.
• September 15. Services Australia reports it to the Australian Signals Directorate.
• September 24. Albanese calls Altman, then tells the press.

That inbox is where academics send vulnerability reports. It’s where the notice landed.

The channel was its own failure

Albanese complained about two things, and the second one gets less attention. Speaking to reporters, quoted by Fortune, he said it took “way too long,” and that “the nature of the way that notification occurred as well was unacceptable.”

A generic inbox. Nine days after the CEO sat across from a minister of the same government.

I’ve spent 36 years building software, and in all that time the playbook for outages has mostly pointed inward: what breaks for us, who gets paged. What an agent changes is direction. Your agent is now a visitor in systems you don’t own (supplier portals, government data sites, competitors’ pricing pages) and every one of them has an administrator who has never heard of you. If something goes wrong there, you are the one who has to make the call. Do you know the number?

Nobody else was watching

The Australian agencies didn’t catch it. According to NPR, the government inquiry will look at why its own security never saw the access before OpenAI’s email arrived, and at whether OpenAI could face criminal charges.

That rhymes with August, when Anthropic’s retrospective review turned up three real intrusions by Claude that the affected companies hadn’t noticed either. In both cases the only party holding logs good enough to see the incident was the one operating the agent. So if you don’t read your agent’s logs, assume nobody will.

Marles put it in terms of a fence: the data “was not sitting behind a particularly high fence” and the agent climbed it without being asked. A low fence doesn’t make it yours.

What I’d want written down first

We covered the eleven weeks OpenAI took to own up to the Austrian wiki incident in September. That post was about how long your vendor takes to warn you. This one flips it: you’re the operator.

Before an agent goes out on the internet under your company’s name, I’d want this on paper.

An allowlist. The sites and systems it may touch. Anything off the list stays off, even when the door is open.

Raw logs of every external action. URL, response, what the agent did next. Not the agent’s own summary of its day.

A review on a fixed date. Weekly at least. OpenAI found this one in a look-back almost two months later. Yours shouldn’t depend on someone remembering to look.

One named owner. A person. “IT” is not a person.

A notification clock that starts when you learn about it. GDPR gives 72 hours for personal data breaches; borrow that number even if the law doesn’t require it of you.

Direct contacts at the third parties that matter. A phone number or a name, never the public inbox.

You don’t need a smarter model for any of this. You need an afternoon before launch, when deciding it is still cheap.

Where we come in

When a company asks us to put agents into production, this plan ships with the agent. In AI Operations we define, with you, what each agent can reach, what gets logged, who reads the logs and who calls whom. It gets written in week one, while the agent is still switched off.

And if your agents already browse third-party sites and you don’t have that contact list, that’s this week’s job.

Let’s write your agents’ incident plan