I've got the feeling that the definition of "hacked" can get somewhat stretched.
Kind of like how someone "hacked" into John Podesta's (during the 2016 elections), but the reality was that he wrote his password on a Post-It note and stuck it on his monitor, or something to that effect.
Gaining unauthorized access to non public files qualifies as a hack by any and every stretch… a hack does not have to be “sexy”, real life is not Hollywood
In the past governments have gone after people for doing things like view source and stumbling across PII (https://www.vice.com/en/article/this-is-the-hacking-investig...), or this teen who was arrested for a serious crime for scraping files from the provincial FOIA site by enumerating the ids of files that had been released by the province and placed on the open web with sequential ids (https://www.cbc.ca/news/canada/nova-scotia/freedom-of-inform...). In both cases, the government claimed the information was non-public, even though all it took to get it was an un-authenticated request on the open web. These cases are like leaving your tax documents on the curb and then being surprised when your neighbour knows your income.
I'll be very curious to read the post mortem and find out if this rises to the level of actual hacking, or if this is just someone in government finding a scapegoat because they left a bunch of shit that was supposed to be "non-public" on the open web and expected no one to find it.
Either way, Agents have a very different umwelt from humans. They don't 'see' the internet the same way we do. Where we see obstacles, they might not notice anything, and where they run into barriers, we might just click right through.
If you're even a bit hacky yourself, you might not see the internet the same way yourself either. Consider little tricks like looking at urls and trying others that fit the pattern; or hitting view source in order to download a pesky image... etc etc.
That's because the hate is often from different groups of people. I think it's rare really for people to universally align on any stance, given what we've been seeing for a while now.
I still think is the angle they are after. Get these things locked down, and then force through the lockdowns with their endless cash. Otherwise, their market becomes commodified with plentiful competitors. It’s a strategy to create an oligopoly.
It seems like what happened here is a user asked for some information about the Australian health system, and while performing a web search, the agent from OpenAI accessed information that should have been confidential or privileged but was somewhere openly accessible...
Edit: I see I've been downvoted for this in light of another commenter providing more detailed information. I'm leaving my comment unedited so that the responses to it are not confusing, but please don't downvote just for the sake of disagreement. I would love to engage with you further if you provide substantive information in the comments. The originally linked article on this post was very light on details.
It mentions swarm of ai agents coordinated to break into the Australian Institute of Health and Welfare (AIHW)
"Earlier this month, OpenAI confirmed Reuters reporting that its AI agents had used website DseWiki to communicate with each other, unbeknownst to them.
Archived versions of this website show more than a dozen OpenAI agents mentioned AIHW over 300 times on this website.
The logs show these AI agents were trying to access data about the average data spent on skin medicines by Victorian local government area.
One agent wrote on the message board: "Question ask January 2022 rolling 12 month average government cost per person for Dematologicals, Victoria LGAs. R1 Wodonga deadline passed; R2 Ballarat passed; R3 expected around 23:10 benchmark / 22:58 wiki time. Need exact data urgently.".
These attempts were initially blocked by cybersecurity provider Cloudflare, which is often used to block non-human traffic while allowing people to access webpages.
The logs show the agents shared information about how they tried to use proxies, screenshotting services and even to guess the file names to try and get around security."
This is such a strange scenario. I can't imagine what the labs were doing that made the agents try to find this information. The HuggingFace incident was relatively clear to track, but I wonder what the postmortem for this one will be!
Thank you for providing more details. The originally linked article was very light on information, so based purely on the comments that Albany's made, I think my conclusion was a fair one :)
The DseWiki incident showed that OpenAI seems to ask its agents time-limited questions on geography-bounded statistics, tasks like finding the average wage of teachers in Wisconsin (made up example), so medical stats in an Australian state does seem to be in the same category of question.
That said, it would be utterly unsurprising to learn that this was a misconfiguration in the website and it was serving stuff that it shouldn't have.
Yeah, this is 100% liability laundering. It's an extremely touchy subject because frankly, the law just isn't prepared for it.
Let's say your goal is "look up <Person X>'s medical history" (for whatever reason), which is not in and of itself a crime. You click around on the AU health website, notice that the URL contains a user ID, change the userID in your browser and access someone else's private health data. This is a crime (right or wrong, it's how the law works now).
If you do that by writing a program to automate changing user IDs to grab everyone's data, it's also a clear-cut crime.[0]
Now if you hire a private investigator to look up Person X's medical history, and they do the same method without your knowledge, you won't be charged with a crime, the PI would, barring something like you telling them to use illegal methods.
So the gap is now: what happens if you prompt OpenAI to look up Person X's medical history, and it does the same thing? Did you commit a crime by prompting the agent? Did OpenAI commit a crime by running the code? If you do the same thing via Claude Code in your terminal, so that the Python which scrapes insecured public data is running on your machine, is the crime on you or on Anthropic? Fundamentally: is the agent a private investigator acting autonomously, or just a piece of code that you wrote?
We don't have answers to any of this which is why "AI Safety" is such a hot topic.
From what I can tell this particular incident wasn't about retrieving data on personal medical records it was accessing (non public) data about Australian government spending on healthcare.
Same concept though. Really "look up someone else's medical history" can be replaced with "achieve any goal which is not a crime on its own, but can be done using criminal methods". There's nothing illegal about asking Claude to give me a million dollars, but if the agent figures out how to hack the bank and move $1m into my account, somebody's going to take the blame.
From everything ive been able to figure out this morning, it sounds like a legacy wordpress website that just uploaded all drafts into a standard s3 bucket that wasn't hard to guess where the files would be.
We still after the 2nd press conference on this by our defense minister are not clear on exactly what happened but thats my best laymen understanding so far.
Intent matters a lot here. Was OpenAI's intent to access private data or simply scrape public data and it stumbled across private data that was not securely held.
If it's the latter the Australian govt should be happy OpenAI noticed and disclosed this as it could've easily gone unnoticed.
I suspect in the coming years we're going to see a lot of govt internet facing services get "hacked" by virtue of not being protected by anything other than obscurity which AI agents will see through in microseconds.
I remember once at Google someone complained that GoogleBot hacked them and deleted their data, and it turned out that GoogleBot was just crawling the pages, and they had unfortunately designed their website so that there was no authentication, page URLs were generally secret, and GET requests to certain URLs were treated as requests to delete data. So once one URL leaked the site got crawled and a lot of data was deleted....
Zero technical details on what the "hack" actually was. Willing to bet it was something as stupid as the data being accessible by changing the query parameter, and rather than own up to their own shoddy security (no doubt built by an offshore contractor) they are going to blame the one who found and reported the bug.
Does it matter whether the data was poorly secured? LLMs should not be hacking into government medical websites, and if they do, the companies responsible should disclose the incidents as soon as possible.
Their efforts to answer a question — including devising ways to access a federal government website blocking their access — was laid out on a German coding website OpenAI had previously confirmed was hijacked by its unreleased AI models in June.
I agree that security was probably awful but the agents did circumvent a block on their access. The definition of “hacking” is fuzzy but this is more nefarious than simple web crawling.
I am certain there would be better guardrails if there were some actual consequences for the people who built these products.
They don't really want guardrails, they want indemnification.
Yeah they don't want that, and the people with power to prevent that don't want it either.
For them, "Winning AI" is effective winning capitalism, winning militarily, and winning the world.
Nothing like "accountability" is going to be allowed to get much in the way of that.
https://www.felonybench.com/ scores increase apace.
No consequences so the behaviour will worsen.
I've got the feeling that the definition of "hacked" can get somewhat stretched.
Kind of like how someone "hacked" into John Podesta's (during the 2016 elections), but the reality was that he wrote his password on a Post-It note and stuck it on his monitor, or something to that effect.
It was likely a phishing attack. A relative of mine somehow got phished for her Google account last month.
Gaining unauthorized access to non public files qualifies as a hack by any and every stretch… a hack does not have to be “sexy”, real life is not Hollywood
Non public has not been clarified.
In the past governments have gone after people for doing things like view source and stumbling across PII (https://www.vice.com/en/article/this-is-the-hacking-investig...), or this teen who was arrested for a serious crime for scraping files from the provincial FOIA site by enumerating the ids of files that had been released by the province and placed on the open web with sequential ids (https://www.cbc.ca/news/canada/nova-scotia/freedom-of-inform...). In both cases, the government claimed the information was non-public, even though all it took to get it was an un-authenticated request on the open web. These cases are like leaving your tax documents on the curb and then being surprised when your neighbour knows your income.
I'll be very curious to read the post mortem and find out if this rises to the level of actual hacking, or if this is just someone in government finding a scapegoat because they left a bunch of shit that was supposed to be "non-public" on the open web and expected no one to find it.
Either way, Agents have a very different umwelt from humans. They don't 'see' the internet the same way we do. Where we see obstacles, they might not notice anything, and where they run into barriers, we might just click right through.
If you're even a bit hacky yourself, you might not see the internet the same way yourself either. Consider little tricks like looking at urls and trying others that fit the pattern; or hitting view source in order to download a pesky image... etc etc.
I get the feeling governments are going to really crack down hard on AI.
And the AI CEO's will have brought it on themselves.
i dont understand why they dont treat this as criminal tresspass.
the legal system exists for a reason. use it!
"A computer system cannot be held criminally responsible, so we must delegate all decisions and actions to it"
Someone initiated the system. They’re the responsible party
We diffused the responsibility thru a committee, just in case.
There is such a weird duality to ai company hate. Hate for releasing products that can hack, and hate for wanting to slow down and work on safeguards.
That's because the hate is often from different groups of people. I think it's rare really for people to universally align on any stance, given what we've been seeing for a while now.
any day now surely.
They won’t, they’re too worried about China or whatever their version of China
I still think is the angle they are after. Get these things locked down, and then force through the lockdowns with their endless cash. Otherwise, their market becomes commodified with plentiful competitors. It’s a strategy to create an oligopoly.
It seems like what happened here is a user asked for some information about the Australian health system, and while performing a web search, the agent from OpenAI accessed information that should have been confidential or privileged but was somewhere openly accessible...
Edit: I see I've been downvoted for this in light of another commenter providing more detailed information. I'm leaving my comment unedited so that the responses to it are not confusing, but please don't downvote just for the sake of disagreement. I would love to engage with you further if you provide substantive information in the comments. The originally linked article on this post was very light on details.
It is hard to find exact information on what happened the best source I've found is this ABC article: https://www.abc.net.au/news/2026-09-24/openai-agents-plotted...
It mentions swarm of ai agents coordinated to break into the Australian Institute of Health and Welfare (AIHW)
"Earlier this month, OpenAI confirmed Reuters reporting that its AI agents had used website DseWiki to communicate with each other, unbeknownst to them.
Archived versions of this website show more than a dozen OpenAI agents mentioned AIHW over 300 times on this website.
The logs show these AI agents were trying to access data about the average data spent on skin medicines by Victorian local government area.
One agent wrote on the message board: "Question ask January 2022 rolling 12 month average government cost per person for Dematologicals, Victoria LGAs. R1 Wodonga deadline passed; R2 Ballarat passed; R3 expected around 23:10 benchmark / 22:58 wiki time. Need exact data urgently.".
These attempts were initially blocked by cybersecurity provider Cloudflare, which is often used to block non-human traffic while allowing people to access webpages.
The logs show the agents shared information about how they tried to use proxies, screenshotting services and even to guess the file names to try and get around security."
This is such a strange scenario. I can't imagine what the labs were doing that made the agents try to find this information. The HuggingFace incident was relatively clear to track, but I wonder what the postmortem for this one will be!
Thank you for providing more details. The originally linked article was very light on information, so based purely on the comments that Albany's made, I think my conclusion was a fair one :)
The DseWiki incident showed that OpenAI seems to ask its agents time-limited questions on geography-bounded statistics, tasks like finding the average wage of teachers in Wisconsin (made up example), so medical stats in an Australian state does seem to be in the same category of question.
That said, it would be utterly unsurprising to learn that this was a misconfiguration in the website and it was serving stuff that it shouldn't have.
Yeah, this is 100% liability laundering. It's an extremely touchy subject because frankly, the law just isn't prepared for it.
Let's say your goal is "look up <Person X>'s medical history" (for whatever reason), which is not in and of itself a crime. You click around on the AU health website, notice that the URL contains a user ID, change the userID in your browser and access someone else's private health data. This is a crime (right or wrong, it's how the law works now).
If you do that by writing a program to automate changing user IDs to grab everyone's data, it's also a clear-cut crime.[0]
Now if you hire a private investigator to look up Person X's medical history, and they do the same method without your knowledge, you won't be charged with a crime, the PI would, barring something like you telling them to use illegal methods.
So the gap is now: what happens if you prompt OpenAI to look up Person X's medical history, and it does the same thing? Did you commit a crime by prompting the agent? Did OpenAI commit a crime by running the code? If you do the same thing via Claude Code in your terminal, so that the Python which scrapes insecured public data is running on your machine, is the crime on you or on Anthropic? Fundamentally: is the agent a private investigator acting autonomously, or just a piece of code that you wrote?
We don't have answers to any of this which is why "AI Safety" is such a hot topic.
[0] https://www.eff.org/cases/us-v-auernheimer
From what I can tell this particular incident wasn't about retrieving data on personal medical records it was accessing (non public) data about Australian government spending on healthcare.
Same concept though. Really "look up someone else's medical history" can be replaced with "achieve any goal which is not a crime on its own, but can be done using criminal methods". There's nothing illegal about asking Claude to give me a million dollars, but if the agent figures out how to hack the bank and move $1m into my account, somebody's going to take the blame.
From everything ive been able to figure out this morning, it sounds like a legacy wordpress website that just uploaded all drafts into a standard s3 bucket that wasn't hard to guess where the files would be.
We still after the 2nd press conference on this by our defense minister are not clear on exactly what happened but thats my best laymen understanding so far.
Intent matters a lot here. Was OpenAI's intent to access private data or simply scrape public data and it stumbled across private data that was not securely held.
If it's the latter the Australian govt should be happy OpenAI noticed and disclosed this as it could've easily gone unnoticed.
I suspect in the coming years we're going to see a lot of govt internet facing services get "hacked" by virtue of not being protected by anything other than obscurity which AI agents will see through in microseconds.
[dupe] https://news.ycombinator.com/item?id=49822556
I remember once at Google someone complained that GoogleBot hacked them and deleted their data, and it turned out that GoogleBot was just crawling the pages, and they had unfortunately designed their website so that there was no authentication, page URLs were generally secret, and GET requests to certain URLs were treated as requests to delete data. So once one URL leaked the site got crawled and a lot of data was deleted....
Zero technical details on what the "hack" actually was. Willing to bet it was something as stupid as the data being accessible by changing the query parameter, and rather than own up to their own shoddy security (no doubt built by an offshore contractor) they are going to blame the one who found and reported the bug.
Does it matter whether the data was poorly secured? LLMs should not be hacking into government medical websites, and if they do, the companies responsible should disclose the incidents as soon as possible.
Yes, it is their responsibility as stewards of their citizens' data. What point are you making with the word "should"?
https://www.abc.net.au/news/2026-09-24/openai-agents-plotted...
I agree that security was probably awful but the agents did circumvent a block on their access. The definition of “hacking” is fuzzy but this is more nefarious than simple web crawling.
From Australia's own national news service: https://www.abc.net.au/news/2026-09-24/openai-agents-plotted...
This was probably the same wiki collusion event we've been discussing on HN before (They're mentioning the same DseWiki that got ... appropriated ).
I guess people are just finding out how far and wide the agents were roaming to get the data they needed for their evals, once they were out.
Previous coverage on HN: https://news.ycombinator.com/item?id=49563355