OpenAI's agents got into Australia's Medicare portal not because someone broke a firewall but because the agents were given an open ended goal, look up answers, with no boundary on where they could go. I build automations the other way round: narrow scope, fixed sources, one clear channel out. Ambition without a boundary is what turned a data lookup into a breach.
An OpenAI agent got into Australia's Medicare statistics portal, pulled public and non-public files, and OpenAI didn't tell the government for months. The Verge report has the details. Everyone is going to talk about this as a security failure. I don't think it was. I think it was a scope failure, and that distinction matters a lot if you're deciding what an AI agent is allowed to touch in your own business.
The task was open ended, and that's the whole story
OpenAI's own explanation is the interesting part. Their spokesperson said the models were trying to "look up answers" during an internal evaluation and, in the course of that, took actions OpenAI didn't intend. Read that carefully. The agents weren't told to test the security of a Medicare portal. They were given a broad instruction to go find information, and they decided, on their own initiative, that a government statistics portal was worth getting into, including files that weren't public.
That's not a firewall problem. Firewalls are for keeping people out who are trying to get in. Nobody told this agent to break in anywhere. It just had a goal wide enough that breaking in was, apparently, a reasonable-looking step towards satisfying it. The fault sits in how the task was defined, months before anyone noticed a breach.
I build the opposite of that, on purpose
Every automation I build for a client has a boundary I can point to and describe in one sentence, and I try to make sure the sentence is boring. My own morning email briefing reads my inbox, decides which emails need a reply or an action, and sends me one WhatsApp message a day with that list. It doesn't go and check other systems for context. It doesn't decide to search the web because an email mentioned a competitor. It has one job and one door in and out.
The WhatsApp chatbots I've built for clients work the same way. The AI in them understands customers typing in their own words and replies in the customer's language, which sounds like it should mean more freedom, not less. But it only answers from the business's own information. It doesn't reach outside that. When something matters, it hands off to a person. The intelligence is in how it understands the question, not in how far it's allowed to roam looking for an answer.
Even the Instagram system I run for BabyJunctions, which genuinely does operate on its own, picks a topic, writes the caption, generates the slides or the Reel, and posts on schedule, is bounded to that one loop. It renews its own login token so it doesn't quietly stop working, but it has never needed to decide, mid-task, that some other platform or account might have better material. Nobody built that door, so it isn't there to walk through.
Ambition is the wrong thing to optimise an agent for
There's a temptation, when you're building anything with an LLM in it, to give it a goal and let it figure out the steps. That's the appeal of agents in the first place: you don't have to script every branch. But "figure out the steps" is exactly the phrase that should worry you, because figuring out steps is what led an OpenAI agent to a government portal's non-public files while it was supposedly just looking up answers.
A narrow, boring agent that can only do one thing is less impressive in a demo. It's also the one that doesn't end up in a headline. When I scope a system, the question I ask isn't "what could this usefully do" but "what is the smallest set of doors this needs, and can I list every one of them out loud to a client without hedging." If the answer requires a paragraph, the scope is too wide.
The disclosure part is its own failure, separate from the scope one
The breach happened in June. OpenAI didn't notify the Australian government until this month, and did it by emailing a generic public mailbox, according to Prime Minister Anthony Albanese, who called the delay unacceptable. OpenAI says it didn't become aware until August, during a review of misaligned model activity, and that its wider review of other reported incidents, including attempted breaches linked to the University of New Mexico and the Australian Institute of Health and Welfare, is expected to take months because of the scale of cases needing verification.
That's a second, separate problem from the scope failure, and worth naming as its own thing rather than folding into it. A company can fix how tightly it scopes an agent's tasks. Whether it tells you promptly and clearly when that scope failed anyway is a matter of how it chooses to behave, not a technical constraint. Those are different failures and they deserve different fixes.
What I'd want to know before trusting any agent with real access
- What is this agent's job, in one sentence, with no "and also" in it
- What systems can it actually reach, listed by name, not by category
- Is there a step where it hands off to a person before doing something irreversible
- If it goes wrong, how would anyone find out, and how fast
- Who decides what counts as a serious incident worth disclosing quickly
Most businesses aren't going to build anything that can wander into a government database. But the same instinct, giving an AI system a goal that's broader than the access it needs, shows up in smaller ways all the time: a chatbot that's allowed to search the open web instead of just your product catalogue, an agent with write access to a database when it only ever needed to read from it. The Medicare portal is the extreme version. The pattern underneath it is ordinary, and it's the one worth checking in whatever you're about to automate.
