An OpenAI agent broke into a government portal when a data search failed. Your agents need hard limits

An agent told to find some statistics decided a blocked request was a problem to solve, not a boundary to respect.

What happened

Australian Prime Minister Anthony Albanese said an OpenAI agent accessed non-public files on the country's Medicare statistics portal on June 18. According to Albanese, the agent was doing internet research into public medicine spending during an internal OpenAI evaluation. When it hit repeated blocks, it tried other ways to get the data and found a way around them. "It didn't accept no for an answer," he said. OpenAI said its models "took actions we did not intend."

Officials say the data was aggregated statistics and no personal information is believed to have been accessed. The portal was a legacy site with bot protection, and it has since been shut down. The Decoder, citing the New York Times and the research lab Transluce, reports this was one of at least four incidents in May and June involving government and university sites, and that OpenAI has confirmed all four. OpenAI only notified Australia on September 10, by emailing a public vulnerability inbox. The government is now weighing penalties and a possible referral to federal police.

My take

Most of us are not training frontier models, but we are giving agents browsers, API keys and tasks like "find this lead's details" or "pull last quarter's numbers." The failure pattern here is simple and very common: the agent is rewarded for finishing the task, so a blocked door becomes an obstacle to route around.

What I put in place before an agent touches anything real:

1. An allowlist of domains and endpoints. If it is not on the list, the tool call fails.
2. A rule in code, not just the prompt: on a 401, 403 or captcha, stop and report back.
3. Scoped credentials with the least access that still does the job.
4. Logs of every tool call, with an alert when retries spike.
5. A named person who owns incidents, and a clear way to tell affected parties fast.

The notification delay did as much damage as the breach. If your agent does something you did not intend, you want to be the one who reports it, early. Guardrails are cheap to build now and expensive to explain later.