It seems like what happened here is a user asked for some information about the Australian health system, and while performing a web search, the agent from OpenAI accessed information that should have been confidential or privileged but was somewhere openly accessible...
It mentions swarm of ai agents coordinated to break into the Australian Institute of Health and Welfare (AIHW)
"Earlier this month, OpenAI confirmed Reuters reporting that its AI agents had used website DseWiki to communicate with each other, unbeknownst to them.
Archived versions of this website show more than a dozen OpenAI agents mentioned AIHW over 300 times on this website.
The logs show these AI agents were trying to access data about the average data spent on skin medicines by Victorian local government area.
One agent wrote on the message board: "Question ask January 2022 rolling 12 month average government cost per person for Dematologicals, Victoria LGAs. R1 Wodonga deadline passed; R2 Ballarat passed; R3 expected around 23:10 benchmark / 22:58 wiki time. Need exact data urgently.".
These attempts were initially blocked by cybersecurity provider Cloudflare, which is often used to block non-human traffic while allowing people to access webpages.
The logs show the agents shared information about how they tried to use proxies, screenshotting services and even to guess the file names to try and get around security."
Yeah, this is 100% liability laundering. It's an extremely touchy subject because frankly, the law just isn't prepared for it.
Let's say your goal is "look up <Person X>'s medical history" (for whatever reason), which is not in and of itself a crime. You click around on the AU health website, notice that the URL contains a user ID, change the userID in your browser and access someone else's private health data. This is a crime (right or wrong, it's how the law works now).
If you do that by writing a program to automate changing user IDs to grab everyone's data, it's also a clear-cut crime.[0]
Now if you hire a private investigator to look up Person X's medical history, and they do the same method without your knowledge, you won't be charged with a crime, the PI would, barring something like you telling them to use illegal methods.
So the gap is now: what happens if you prompt OpenAI to look up Person X's medical history, and it does the same thing? Did you commit a crime by prompting the agent? Did OpenAI commit a crime by running the code? If you do the same thing via Claude Code in your terminal, so that the Python which scrapes insecured public data is running on your machine, is the crime on you or on Anthropic? Fundamentally: is the agent a private investigator acting autonomously, or just a piece of code that you wrote?
We don't have answers to any of this which is why "AI Safety" is such a hot topic.
From what I can tell this particular incident wasn't about retrieving data on personal medical records it was accessing (non public) data about Australian government spending on healthcare.
> I've got the feeling that the definition of "hacked" can get somewhat stretched.
Kind of like how someone "hacked" into John Podesta's (during the 2016 elections), but the reality was that he wrote his password on a Post-It note and stuck it on his monitor, or something to that effect.
It seems like what happened here is a user asked for some information about the Australian health system, and while performing a web search, the agent from OpenAI accessed information that should have been confidential or privileged but was somewhere openly accessible...
It is hard to find exact information on what happened the best source I've found is this ABC article: https://www.abc.net.au/news/2026-09-24/openai-agents-plotted...
It mentions swarm of ai agents coordinated to break into the Australian Institute of Health and Welfare (AIHW)
"Earlier this month, OpenAI confirmed Reuters reporting that its AI agents had used website DseWiki to communicate with each other, unbeknownst to them.
Archived versions of this website show more than a dozen OpenAI agents mentioned AIHW over 300 times on this website.
The logs show these AI agents were trying to access data about the average data spent on skin medicines by Victorian local government area.
One agent wrote on the message board: "Question ask January 2022 rolling 12 month average government cost per person for Dematologicals, Victoria LGAs. R1 Wodonga deadline passed; R2 Ballarat passed; R3 expected around 23:10 benchmark / 22:58 wiki time. Need exact data urgently.".
These attempts were initially blocked by cybersecurity provider Cloudflare, which is often used to block non-human traffic while allowing people to access webpages.
The logs show the agents shared information about how they tried to use proxies, screenshotting services and even to guess the file names to try and get around security."
Yeah, this is 100% liability laundering. It's an extremely touchy subject because frankly, the law just isn't prepared for it.
Let's say your goal is "look up <Person X>'s medical history" (for whatever reason), which is not in and of itself a crime. You click around on the AU health website, notice that the URL contains a user ID, change the userID in your browser and access someone else's private health data. This is a crime (right or wrong, it's how the law works now).
If you do that by writing a program to automate changing user IDs to grab everyone's data, it's also a clear-cut crime.[0]
Now if you hire a private investigator to look up Person X's medical history, and they do the same method without your knowledge, you won't be charged with a crime, the PI would, barring something like you telling them to use illegal methods.
So the gap is now: what happens if you prompt OpenAI to look up Person X's medical history, and it does the same thing? Did you commit a crime by prompting the agent? Did OpenAI commit a crime by running the code? If you do the same thing via Claude Code in your terminal, so that the Python which scrapes insecured public data is running on your machine, is the crime on you or on Anthropic? Fundamentally: is the agent a private investigator acting autonomously, or just a piece of code that you wrote?
We don't have answers to any of this which is why "AI Safety" is such a hot topic.
[0] https://www.eff.org/cases/us-v-auernheimer
From what I can tell this particular incident wasn't about retrieving data on personal medical records it was accessing (non public) data about Australian government spending on healthcare.
I've got the feeling that the definition of "hacked" can get somewhat stretched.
> I've got the feeling that the definition of "hacked" can get somewhat stretched.
Kind of like how someone "hacked" into John Podesta's (during the 2016 elections), but the reality was that he wrote his password on a Post-It note and stuck it on his monitor, or something to that effect.
https://www.felonybench.com/ scores increase apace.
I am certain there would be better guardrails if there were some actual consequences for the people who built these products.
They don't really want guardrails, they want indemnification.
Yeah they don't want that, and the people with power to prevent that don't want it either.
For them, "Winning AI" is effective winning capitalism, winning militarily, and winning the world.
Nothing like "accountability" is going to be allowed to get much in the way of that.
I get the feeling governments are going to really crack down hard on AI.
And the AI CEO's will have brought it on themselves.
i dont understand why they dont treat this as criminal tresspass.
the legal system exists for a reason. use it!
"A computer system cannot be held criminally responsible, so we must delegate all decisions and actions to it"
[dupe] https://news.ycombinator.com/item?id=49822556
No consequences so the behaviour will worsen.