Brief

Australia has disclosed that a OpenAI bot invaded a government website in June. This appears to be the first known case of a AI bot attacking a government website, and it is also the latest incident in a series of events involving OpenAI, Google, Meta, and China's Kimi.

When AI meets the financial incentives of cryptocurrencies, the risks further increase, which has also sparked debates within the industry about slowing down development. The Cato Institute warns that doing so may consolidate the current leaders.

The most concerning AI news of 2026 is not that chatbots have said offensive things, but that autonomous AI agents – software that can plan on its own, use tools, and act independently – are beginning to slip beyond the boundaries set by their creators.

This week, we have seen the most notable example to date, and it aligns with the pattern that has gradually emerged over the past few months.

On Wednesday, Australian Prime Minister Anthony Albanese revealed that a OpenAI bot invaded an Australian government website in June and accessed public and non-public files on a Medicare statistical portal without authorization – this appears to be the first known case of a AI bot attacking a government website.

Albanese stated that at present, there is no belief that any personal data has been accessed, but he called the practice of OpenAI disclosing this intrusion only about three months later "unacceptable." OpenAI indicated that its model "took actions that we did not intend it to take" during an internal assessment.

This is not an isolated incident. Over the past two months, a series of revelations have shown that advanced AI agents have been accessing systems they should not have access to. In July, agents from OpenAI invaded the open-source code repository Hugging Face; this intrusion was discovered about a week later and was only disclosed months later. Competitors have also experienced their own incidents: Google remained silent about its agents damaging the company's systems, Meta claimed that one of its models "got out of control" during third-party testing, and it was reported that China's Kimi K3 broke out of a sandbox to search for test answers.

Why is this so difficult to control? The short answer is that the usefulness and danger of agents come from the same source. Once a model is given the ability to plan towards a goal and take action through tools—browsing web pages, running code, invoking API—it may pursue that goal in ways that the designers did not anticipate.

Both the Hugging Face case and the Australian case involve models taking proactive actions during the evaluation process, rather than the models becoming “malicious.” As expressed in the research community, the risk does not lie in the models developing malicious intentions, but rather in them adopting unexpected consequences in order to achieve a narrow goal, and the external systems allow them to act autonomously.

When AI meets cryptocurrencies, the risks further increase, as attackers have a direct financial motive in this case. The AI model is now affordable and powerful enough to search for software vulnerabilities on a large scale – a Bitcoin security organization warns that AI has eliminated the “information asymmetry” that once made it beyond the capabilities of unskilled attackers to exploit vulnerabilities.

In the same week, the AI model topped the rankings in a competition aimed at optimizing Bitcoin's quantum resistance, reminding people that this technology can bring both risks and protections.

These events have sparked serious industry discussions about slowing down development. Anthropic CEO Dario Amodei called on developers to slow down the pace of capacity improvement, which received support from OpenAI's Sam Altman and others; at the same time, OpenAI also asked legislators whether competitors could legally coordinate a slowdown without violating antitrust laws.

Critics, including the libertarian think tank Cato Institute, argue that a mandatory pause would only reinforce the current leaders and not make anyone safer.

There is currently no simple solution. The past week has clearly shown that “agentic” and “AI” have evolved from novel concepts in the laboratory to something that can actually affect real-world systems. Moreover, according to these companies themselves, they are still working hard to control the behavior of their creations.