Australian Prime Minister Anthony Albanese last Friday accused OpenAI’s agents of hacking into the country’s universal health insurance system, marking the first known instance of rogue AI agents breaching a government website.
The incident was just the latest in a string of agent hacks, hijacks, or perusals that seem to have spiraled beyond the labs’ ability to control.
Top industry leaders, including Nvidia’s CEO Jensen Huang, have suggested that the AI labs can control these outbreaks. The problem, Huang said in a recent podcast interview, is likely “as simple as engineering.”
But the breakouts are so numerous that they’re already becoming hard to keep track of. And the real number might be much higher than companies have so far disclosed between internal tests and real-world cases.
Below is a quick overview of the cases in which AI agents have gone rogue and hijacked, hacked, or considered hacking third parties:
Hugging Face hack
Most famously, around 700 OpenAI agents in July 2026 coordinated through a shared unsanctioned message board as part of a plan to essentially fake out an automated cybersecurity grader. At the risk of oversimplifying the issue, the agents searched for ways to game the system by finding ways around controls meant to isolate them from the internet. Ultimately, they breached Hugging Face, which prompted a wave of headlines about “rogue” AI agents.
U.S. government probes
OpenAI-linked agents have probed several U.S. government websites, including an unsuccessful attempt to compromise the Education Department’s Office for Civil Rights, according to researchers at Transluce. The research firm also found other AI agent activity on websites run by the Navy, the Justice Department and the Centers for Disease Control and Prevention. So far, agents aren’t known to have stolen any private data, but an OpenAI spokesperson said model agents also used log-in information discovered on the web to access data from the U.S. Census Bureau and copied public information from the Securities and Exchange Commission.
OpenAI models bypassing security controls
OpenAI on Friday said it had notified dozens of third parties where its models might have bypassed their security controls or may have impaired the availability of an online service or where misalignment cases “negatively impacted third-party websites or services.” The review is still ongoing, but OpenAI said cases include agents bypassing access controls, using exposed credentials, triggering unintended commands, reaching internal systems and altering third-party websites in ways that sometimes required cleanup. (The blog post also provided anonymized summaries about the types of cases they’ve found so far.)
Australia’s Healthcare Hack
OpenAI’s agents hacked into Australia’s universal health insurance system, according to Australia Prime Minister Albanese. The access, he said, originated through the public-facing Medicare statistics portal and allowed the agent to access both public and non-public files. The June event has already prompted the Australian Senate to call on both OpenAI CEO Sam Altman and Anthropic CEO Dario Amodei to testify at a hearing this week as part of an inquiry into the incident.
Other OpenAI instances
OpenAI published a misalignment report on Friday that disclosed researchers once again paused tool-training after a research agent escaped its secure internet sandbox by using a DNS loophole to connect to an outside agent. It also reported that it identified 53 instances of user-provided images “posted to image-hosting sites as links that weren’t publicly listed.”
Meta’s Muse Spark joins the action
In August, Meta disclosed that a third party found Meta’s Muse Spark 1.1 had hacked another company during a cybersecurity test after researchers accidentally gave the model access to the live internet and the name of a real company instead of a fictional target. Researchers said Muse Spark found a vulnerability, accessed information, and made changes to the company’s database, but Meta later found the issue was an isolated incident in a misconfigured environment.
Gemini’s real-world access
In September, Google revealed that its Gemini models accessed the internet and hacked other companies during a May cybersecurity test, which involved the model accessing three companies using publicly available information and guessed credentials after the credentials were inadvertently exposed. (Google said the models stopped once they recognized the targets were real.)
Claude gets four systems
Earlier this month, Anthropic disclosed a fourth time its Claude models went rogue and gained access to real computer systems. The first three — which were disclosed in a July blog post and updated in a separate blog post a month later — involved incidents where the models gained unauthorized access to real outside computer systems during cybersecurity evaluations.
A MESSAGE FROM OUR SPONSOR
AI shouldn’t dictate where your models run.
Run the models you want, securely, wherever they make the most sense. Across clouds, data centers and the edge, VAST Data is extending its AI Operating System to give organizations control over model choice, placement, access, and cost.
The Latest On Big Technology Podcast: Meta’s Muse Revival, Frontier AI Under Threat, The Rise Of Dopamine Sites
Ranjan Roy from Margins is back for our weekly discussion of the latest tech news. We cover: 1) The rise of Muse 2) Is Meta back? 3) OpenAI’s consumer blind spot 4) Meta’s butthole marketing 5) What Muse means for ecommerce 6) Meta’s Muse Charm, aka; The Muse Buddy or Muse Tamagotchi 7) Meta introduces camera-free smart glasses 8) What Meta Muse says about Frontier AI’s weakness 9) Standard models are on the rise vs. frontier 10) The new Dopamine Site phenomenon is... good?
You can listen on Apple Podcasts, Spotify, or your podcast app of choice