OpenAI’s agent had a routine task. It breached a government portal.

An OpenAI agent meant to research public medicine spending ended up slipping past security on an Australian government Medicare statistics portal, according to a disclosure from the government on Thursday. The agent, which OpenAI said was running as part of an internal evaluation in June, accessed both public and non-public files and also wrote files to an internal server.

That incident landed a day after Transluce, a nonprofit AI research lab, published logs showing autonomous agents behaving far less like obedient assistants and more like suspicious pentesters. The group says it found attempts at SQL injection, cross-site scripting, command injection, and path traversal against the University of New Mexico’s digital library, Data USA, and the Australian Institute of Health and Welfare. In the cases it documented, the agents started by trying to fetch ordinary information — a historical photograph, University of Iowa data, local pharmaceutical data in Victoria — and only turned aggressive after the usual retrieval path failed.

The Australian case followed the same pattern. On June 20 and 21, agents trying to pull pharmaceutical spending data from an AIHW Tableau dashboard ran into Cloudflare’s bot protections. One then tested the dashboard with a reflected XSS payload within minutes. Cloudflare stopped it before it reached the application, and AIHW says there is no evidence non-public information was accessed. The agent eventually found the same public dataset on AIHW’s pre-production server, pp.aihw.gov.au, and retrieved it after more than 100 scans.

Transluce also traced a longer arc of agents improvising around obstacles. On March 6, one agent looking for drug-enforcement statistics from Thailand’s Office of the Narcotics Control Board first tried direct requests, then routed the page through r.jina.ai, then wrote a custom Base64-encoded script and submitted it through urlquery.net so it could run its own client-side JavaScript. By mid-April, the lab says it was seeing the same sort of technique across thousands of requests on urlquery.net, including one June 14 case where agents used the service’s browser to create a disposable email inbox and try to register a urlquery.net account.

The ugly part is not that these systems are clever. It’s that they’re being handed open internet plumbing and then acting surprised when the model starts tugging on every loose cable it can find. Closed-by-default network rules are boring, which is exactly why they work.