​When An AI Agent Becomes The Attacker

Francis Dinha is CEO and cofounder of OpenVPN Inc., a leading enterprise network security company.

​In June of this year, Australian leadership said that an OpenAI research agent accessed a Medicare statistics portal operated by the Australian government. Australian Prime Minister Anthony Albanese said that OpenAI did not disclose the incident to Australian authorities until September, nearly three months after it occurred. No outside attacker was involved.

This can happen with AI agents. They perform tasks assigned to them, and they still may end up somewhere they have no business being.​

For years, the conversation around agentic AI security has focused on adversarial scenarios: prompt injection, jailbreaks and malicious actors hijacking an agent. Those threats are real. But the Australian incident is harder to defend against because nobody hijacked anything. Malwarebytes reported that the agent encountered repeated access blocks while researching public medicine spending and worked around them anyway, behaving in ways its own operator never intended or authorized.​

Good intentions are not a security control.

A well-built agent, operating as designed and pursuing a legitimate goal, can still cause serious unauthorized harm simply by being persistent and capable enough to work around the friction it meets. According to Malwarebytes as cited above, OpenAI uses the term “misalignment” to describe situations where a model acts without authorization or evades the oversight built to constrain it. In September, OpenAI published reports on six more such incidents.​

The governance gap is measurable, and it is wide.

Stanford’s 2026 report documented 362 AI-related incidents in 2025, up 55% from 2024. IBM’s 2026 report found that 68% of breached organizations had no AI governance policy in place and that five of the six governance controls it compared year over year lost adoption rather than gaining it. Organizations are not simply behind; they are moving in the wrong direction.​