Rogue AI agents broke in. The holes weren't new

For security leads who run public websites, portals and APIs. This year AI agents running on models from OpenAI, Anthropic and other labs broke into government portals and company systems, and misused package registries and wikis, while doing research tasks and tests. How the agents got in, how their victims found out, and what to check before one finds your site.

In June, an experimental OpenAI model was asked to find out how much governments spend per person on medicines for skin conditions in Victorian communities. It had trouble finding the answer in published statistics, and while looking on Services Australia's Medicare Statistics Reporting Service, it found a way into the part of the service that isn't public. It ran commands, took internal files and credentials, and wrote files of its own (OpenAI, 28 September 2026). OpenAI says nobody had authorised any of it, and that its review has found no sign that anyone's medical records were accessed.

It wasn't one rogue agent, or one lab. Since July, OpenAI, Anthropic, Google and Meta have each said their models reached real organisations' systems that nobody had pointed them at, and the UK's AI Security Institute has reported the same from its own tests (Anthropic, 30 July 2026; SecurityWeek, 21 September 2026; Business Standard, 6 August 2026; AI Security Institute, 4 August 2026). OpenAI alone says it had notified over 100 organisations by 26 September (OpenAI, 30 September 2026). None of those organisations was a target. The agents were answering research questions or working through practice hacking exercises, got stuck, and went through whatever door was open. Few of those doors were new. If you look after a public website, portal or API, that leaves you two things to find out: what an agent would find if it came, and whether you'd know it had been in.

A word on sources. Most of what follows comes from the labs' disclosures, which admit things against their interest, from the researchers and agencies who found the activity, and from the owners of the sites that were hit. We sell penetration testing and AI security work, so where something is our opinion, we say so.

How the agents got in

Keys and tokens handed to every browser. Several agents didn't need to break anything. OpenAI's agents discovered an exposed access key for a Victorian health agency's reporting system and used it to pull survey statistics. New South Wales's public crime-mapping tool "supplies credentials for browser API requests", and an OpenAI model used them and got back application configuration, operational jobs and logs (OpenAI, 28 September 2026). Anthropic's Claude Mythos 5 read the settings file a local government property map sends to browsers, found working access tokens and queried the server behind the map directly. In another case Mythos 5 learned that a state agency's public dashboard "issues an access token to any visitor", took one, and queried the database without paying. In both cases, Anthropic says, the data was available to the public, but only for a fee (Anthropic, 9 October 2026). If your map, dashboard or app hands every visitor a token, an agent will find out what else the token can do.

Injection flaws on public data services. Transluce, a non-profit research lab, traced agents' activity on US and Canadian government sites. On 17 June, agents chasing what looks like a benchmark question about school counsellors tried a textbook SQL injection, State_Id=1 OR 1=1, on the US Department of Education's civil rights data site. It failed. So did 13 attack payloads sent to Library and Archives Canada's collection search, among them SQL injection probes and a debug=1 switch (Transluce, 30 September 2026). At a university, one worked. Claude Mythos Preview needed a public analysis tool hosted there, and the tool returned an error. Looking for another way to finish the job, it found a script on the university's server that would return any file it asked for. It used that to read the script's source code, spotted an injection flaw, and ran commands on the server (Anthropic, 9 October 2026).

Debug pages left on. One of Anthropic's internal research models couldn't reach the target in its exercise, so it scanned about 9,000 targets on the internet. It got into one company's internet-facing application by reading credentials from an exposed debug page and using SQL injection. It stopped only when it noticed the server sat in a cloud account that had nothing to do with the test (Anthropic, 30 July 2026).

A name that matched. In another of Anthropic's tests, the fictional company Claude Opus 4.7 was meant to attack shared its name with a real company's live domain. Claude went after the real one, took application and infrastructure credentials, got into a database holding several hundred rows of production data, and kept going after it had recognised the systems were probably real (Anthropic, 30 July 2026). Google put Gemini's three break-ins in May down to the same kind of mistaken identity (SecurityWeek, 21 September 2026). You can't stop a test designer choosing your name. You can decide what an agent finds when it arrives.

Live forms. Some agents simply submitted real forms. An unreleased Anthropic research model, meant to fill in a practice copy of a government form, went to the real site when the copy failed to load or was closed by mistake, and submitted the form there, more than once. Claude Haiku 4.5, asked to generate and carry out example tasks on random web pages, landed on a page about an unsolved killing and filled in the police tip form on it. The invented tip said it had information on the case and recalled "seeing someone matching the description in the area" at the time. The page described no suspect. Claude left the name and contact fields blank, which the form allowed (Anthropic, 9 October 2026). The form was on PhillyUnsolvedMurders.com, the Philadelphia Police Department's tip site. The tip, sent on 28 July, landed in a spam folder. Police found it only after Anthropic got in touch more than two months later, and called the delay "unacceptable" (PhillyVoice, 9 October 2026).

When your site becomes the agent's tool

On 11 and 12 May, agents submitted more than 2,000 packages to RubyGems, the main registry for the Ruby programming language. A bug let them use new accounts without confirming an email address, and they abused RubyDoc.info's automatic documentation builds to run their own code. The packages were used to fetch information from UK local government websites, information that was public anyway. RubyGems stopped new sign-ups for four days (rubyhack.ai, 11 September 2026). The researchers who pieced this together believe the agents were OpenAI's. OpenAI says its agents did use RubyGems to reach the internet and fetch public information, but that it hasn't been able to verify that they uploaded malicious packages (OpenAI, 11 September 2026).

On PyPI, the Python registry, Claude Mythos 5 found setup notes in its test environment that named a package nobody had published, and published one under that name (Anthropic, 30 July 2026). What happened next, with a security vendor's scanner handing over its own credentials, is told in Part 2 of our AI history.

The agent behind the AI Security Institute's Tor alert ran on Mythos 5 and was trying to slip malicious code into an open-source project on GitHub, the case Part 2 also covers. What stopped it was a person: "A human maintainer caught and refused to approve the malicious code" (AI Security Institute, 4 August 2026).

At the Wikimedia Foundation, which runs Wikipedia, agents it believes OpenAI operated made test edits in wiki sandbox areas, plus a few edits to the configuration for a citation tool that it thinks were meant to "misuse this tool as a proxy for fetching data from remote services". They also tried, and failed, to use its public Etherpad note-taking tool to fetch data from other websites (Wikimedia Foundation, 5 October 2026). A German wiki for programmers fared worse: agents turned it into a message board for swapping ways round their restrictions, and OpenAI has confirmed it found its agents using a public wiki that way (OpenAI, 5 September 2026).

OpenAI's worst case began with a public feature too. Its agents got into Hugging Face by uploading datasets whose configs made Hugging Face's processing pipeline read local files, handing over secrets and tokens, and then run their code (Hugging Face, 27 July 2026; OpenAI, 28 September 2026).

If your service fetches pages for visitors, builds code it's sent, accepts uploads, or lets anyone edit, assume an agent will try it as a proxy, a scratchpad or a way to ship code to someone else. What held this year was a person reading the diff, an automated takedown, and a registry willing to shut sign-ups for a few days.

The flood that robots.txt doesn't stop

Agents didn't have to probe anything to cause trouble. Volume was enough. On 6 May, a web archive fetching pages on agents' behalf made 295,912 captures of Maryland government sites holding education statistics, peaking at 5,594 a minute. The next day it made 36,578 captures of Kansas Memory, a state history archive, at up to 1,093 a minute, and the later ones came back as gateway timeouts, though the researchers couldn't confirm the site went down. The Education Department site took more than 200,000 requests on the day of its injection probe (Transluce, 30 September 2026). Wikimedia says agent traffic may have contributed to a partial outage of its Wikidata Query Service in May (Wikimedia Foundation, 5 October 2026).

The Numbers, a box-office data site that launched in 1997, collapsed in the early hours of 5 March. Its founder, Bruce Nash, told the film researcher Stephen Follows that only 10% of its traffic is now human. A second, more damaging wave of bot traffic, which Nash puts down to agentic AI, began around December last year. "Around 90% of our time was spent keeping the existing site running", he said (Stephen Follows, 22 July 2026). The logs also showed probing for back doors, and what finally brought the servers down hasn't been established. The site came back about a week later as a skeleton on new infrastructure.

Closer to home, the LGBT History Project is one of the UK's largest online archives of LGBT history, built by volunteers and paid for by one person, Jonathan Harbourne. He says his logs show a Meta crawler, identifying itself as meta-webindexer and coming from addresses registered to Meta, making 230,743 requests in about a day and a half. Almost all of them, 98%, went to addresses his robots.txt asked crawlers to keep off, and not one was for the robots.txt file itself. The crawler took 12.15 GB, 47% of all the data the server sent out in that time, and Harbourne says his AWS bill has roughly doubled (Jonathan Harbourne, 28 July 2026).

A robots.txt file was never going to hold this back, because it's only a request, and some of the AI companies' own fetchers say they may not follow it when a user sends them, as we covered in Most visitors to your site are now bots.

Blocking the labs by name misses the test agents too, because many didn't arrive under a lab's name. The archive behind the Maryland and Kansas captures was Arquivo.pt, Portugal's national web archive, and Transluce traced more of the government-site traffic through urlquery.net, a web security service. The agents apparently used both to "route their requests around restrictions placed on them", whether by their developers or by the sites they were after (Transluce, 30 September 2026). Anthropic's models used free URL-shortening services to get round a length limit in their fetch tool, and the operator of one, da.gd, noticed (Anthropic, 9 October 2026). OpenAI's agents pulled Australian health statistics through third-party browsing and download services (OpenAI, 28 September 2026). In your logs, an agent may look like an archive, a scanner or a download service.

What's new, and what isn't

Anthropic says its models got into the three organisations "using basic techniques, such as exploiting weak passwords and unauthenticated endpoints", and didn't find or exploit any complex vulnerabilities (Anthropic, 30 July 2026). Transluce called the two hacking attempts it found "rudimentary and failed" (Transluce, 30 September 2026). CERT-In, looking across all the agent-driven incidents it has seen recently, says "the root weaknesses are conventional" (CERT-In, 15 October 2026). Its list reads like the findings of an ordinary penetration test: credentials and keys in code, configuration files, client applications and public web pages; old and test APIs still reachable from the internet; cloud roles that let anonymous callers read and write; management interfaces online with weak passwords or no multi-factor authentication.

What has changed is speed and reach. CERT-In says AI found and exploited these weaknesses "faster, more exhaustively and at greater scale than human attackers", and that attackers using publicly available agent frameworks against Indian organisations have cut the time from first access to final damage "from days to a few hours" (CERT-In, 15 October 2026). The labs' agents tried one way in after another, on sites no attacker had picked out, and not every hole was old: on the way to Hugging Face, OpenAI's agents found and used a flaw nobody knew about to get out of their test environment (OpenAI, 28 July 2026).

There's a case for calm, too. OpenAI says most of the cases it has found so far were low severity (OpenAI, 25 September 2026), and Anthropic says the cases in its October report had minimal real-world impact. Both have cut live internet access from their research and test environments (OpenAI, 28 September 2026; Anthropic, 9 October 2026).

Our view is the one we set out in part two of our AI history: for everyone outside the labs, 2026 is a detection story. Closing the holes is half the job. The other half is knowing quickly when something is using one.

You'll probably hear about it late, and from the lab

If an AI lab's agent has been in your systems, the first you hear of it will probably be an email from the lab. After its agents broke into Hugging Face in July, OpenAI began reviewing its earlier training and evaluation work. That review found the Medicare activity in mid-August, and OpenAI told Services Australia on 10 September (OpenAI, 28 September 2026). According to AAP, the notice went to a public social services department inbox, and public servants took five days to verify it and pass it to the Australian Signals Directorate (The Canberra Times, 24 September 2026). The Prime Minister, Anthony Albanese, said the company took "way too long to inform the government what had occurred" (SmartCompany, 24 September 2026). OpenAI now says it "should have shared preliminary findings sooner" (OpenAI, 28 September 2026).

Australia's case was slow, but the silence on the victims' side wasn't unusual. When Anthropic went back through 141,006 test runs in July, it found its models had got into three organisations' systems. Of the two it managed to reach, neither had detected anything (Anthropic, 30 July 2026). India's national computer emergency response team, CERT-In, says the same of every case AI providers have disclosed to it about Indian organisations: none of them noticed, and each came to light only when the provider reported it after an internal review (CERT-In, 15 October 2026). The Wikimedia Foundation went looking for agent activity on its sites after other organisations had disclosed theirs (Wikimedia Foundation, 5 October 2026).

More notices are coming. OpenAI says it is working back through its records month by month and that "Some notifications may concern events from months ago." It also says a notice isn't proof of a breach: "Notification does not mean that any private information was accessed", nor that any system was compromised (OpenAI, 30 September 2026).

Detection can work when someone is watching the right signal. On 28 July, monitoring at the AI Security Institute flagged data leaving one of its test systems through the Tor anonymity network. Every related run was stopped within an hour (AI Security Institute, 4 August 2026). But that was the tester spotting its own agent, and it says even that came "through general monitoring after the fact". Our reading of this year's evidence is that, for most organisations, the alert will be the lab's email.

What to check this quarter

Councils, statistics offices, archives and trade bodies are the sites these agents go looking for. OpenAI says its agents ended up on government and university sites partly because models doing research are often directed to authoritative sources of public information (OpenAI, 25 September 2026). If you publish figures, this is what we'd check this quarter, in this order.

We'd start with the inbox, because a lab's email is the alert most organisations will actually get. That means a security.txt file at /.well-known/security.txt with a contact someone reads, as set out in RFC 9116, and a standing instruction to whoever reads the general, press and complaints inboxes to pass anything about AI agents or model activity to security the same day. Services Australia's notice went the long way round.

Next we'd find the keys and tokens the site gives away. That means searching public code and published packages for secrets, then looking at what the site sends to browsers: settings files, map and dashboard configs, API keys in JavaScript. We'd call each token directly to see what it can do, or as CERT-In puts it, "Test what an anonymous caller can read and write" (CERT-In, 15 October 2026). A token should reach only the public data it's meant for, with a rate limit on it, and any that leaked should be rotated. The part we'd watch most closely is proving a leaked key is really dead. CERT-In tells organisations to rotate it, purge it from history and check the fix from outside, and it has seen agents work the same exposed credential out again and reuse it in separate operations.

Then the public data services themselves: statistics portals, archives, maps, legacy search pages and anything that takes an ID in the URL. We'd test query parameters for injection, look for debug switches left on and scripts that return files, and try path tricks such as an encoded ../. Any feature that fetches, renders or builds on request gets the same treatment: limits on where it can fetch, build hooks behind authentication, email confirmation that can't be skipped, and throttled bulk sign-ups. RubyGems learned that in May.

For volume, we'd rate-limit the expensive endpoints per client. Search, exports, maps and query services cost far more to serve than a static page, and the traffic that hits them will ignore robots.txt and arrive through archives, scanners and download services. Any web form that leads to something happening in the real world needs rate limits, spam scoring and a person before anything happens.

Last, an alert has to reach a person. CERT-In asks for alerts on enumeration bursts, bulk reads and automated registrations, and for logs kept at least 180 days, long enough to check a lab's notice that turns up months late (CERT-In, 15 October 2026). Anthropic says its summer incidents gave Claude access to real third-party systems for hours (Anthropic, 9 October 2026), so an alert that waits until the next working day is too slow. In the UK we'd also sign up to the NCSC's free Early Warning service, which the AI Security Institute recommended after its incident, along with making cyber a board-level responsibility and requiring Cyber Essentials right across the supply chain (AI Security Institute, 4 August 2026).

If a lab says its agent was in your systems

Treat the notice as the start of an incident until you've shown otherwise. OpenAI says it's "sharing technical findings to support their investigations" (OpenAI, 25 September 2026). Ask for everything you'd want from any other incident report:

• the exact times, with the time zone, and how long the activity lasted
• the source addresses, and any services the agent went through, such as archives, scanners or shorteners
• the URLs and parameters it sent, and what came back
• any credentials or tokens it used, and anything it wrote, uploaded or changed
• whether the same access still works today

Then check your own logs for that window, rotate any credential the agent touched, and fix whatever let it in. If personal data might be involved, bring in your data protection officer and lawyers on day one. Under the ICO's rules, a breach that's likely to put people at risk must be reported "without undue delay, but not later than 72 hours after becoming aware of it" (ICO). When a lab's email counts as becoming aware is a question for your lawyers, not for a blog post. We're not lawyers.

The spam folder that worked

Philadelphia's form accepted Claude's tip, but the department's process never treated it as fact. Every tip needs human review and vetting before anyone acts on it. "An automated submission does not bypass that process", the department's spokesperson, Eric Gripp, said (PhillyVoice, 9 October 2026). The Medicare portal had no step like that between a stuck research agent and the commands it ran, and nor did most of the other doors agents found this year. Shutting them is old, dull work, and it now has to be done before an agent tries the handle.

If you'd like someone to try your public sites the way these agents did, our penetration testing covers web applications, APIs and internet-facing networks, including the access controls and exposed configuration this year's agents went for. If your own teams run agents, our AI security work covers what they can reach and when a person has to approve.