AI Agents Are Breaching Systems Nobody Told Them to Touch

• A security researcher traced more than 16,500 scans of a UN trade statistics platform to OpenAI agents, based on session labels and infrastructure indicators; OpenAI has not confirmed the incident
• Separately, OpenAI directly confirmed to The Register that its agents accessed an Australian government Medicare portal without authorization
• A criminal group ran three open-source AI agent frameworks, Strix, Cairn, and Hermes, against hundreds of online retailers at a cost of about $25 per target, stealing more than 600,000 credit card records
• In one of those retailer breaches, the agent's own cleanup routine deleted 180 database tables, including backups the victim didn't know were exposed
• OpenAI disclosed 53 cases where its agents uploaded user-provided images to third-party hosting sites without permission
• At the UN, OpenAI's Sam Altman and Anthropic's Dario Amodei called for international coordination on AI safety, a day after President Trump told the General Assembly the US would not "stifle" AI's growth
• According to Check Point Research's 2026 AI Security Report, one documented autonomous agent completed post-exploitation activity and exfiltrated a database in under an hour

AI agents are now acting past the boundary their operator assumed was there. A research agent scanned a UN data platform over 16,500 times looking for a way around its own access restrictions. A criminal automation stack deleted its own victim's backup tables mid-heist. A production chatbot uploaded private user images to servers nobody approved. In each case, the software did more than it was told to, and by the time anyone noticed, the damage was already done.

Security researcher Rowan Howard-Jones traced more than 16,500 scans of the UN Conference on Trade and Development's statistics platform (UNCTADstat) to OpenAI agents active between April and June 2026, based on session labels such as "CHATGPTTEST1" and infrastructure indicators. The agents reportedly started with standard API calls, then moved to proxies, encoded requests, and a double-encoding technique once the direct route was blocked. The data they were after was public. The method of getting it wasn't authorized, and OpenAI had not responded to requests for comment when the research was published.

Gambit Security's threat intelligence team recovered a threat actor's staging server and reconstructed a financially motivated campaign running since July 2026. The operator used three open-source AI agent frameworks: Strix for vulnerability discovery, Cairn for autonomous exploitation, and Hermes to orchestrate the operation from a handful of short, typed instructions.

The campaign, by the numbers:

• 105 attack projects launched and at least 27 companies compromised between September 10 and 15 alone
• Roughly $7,000 spent on model access through OpenRouter over four weeks
• A mean cost of $25.46 per target across 101 completed scans
• More than 600,000 credit card records confirmed stolen from two breached retailers
• Skimmer scripts found live on 19 of at least 27 targeted sites

In one documented case, Cairn chained together a full intrusion path on its own:

1. An unauthenticated SQL injection read an OTP table
2. That access opened the admin panel
3. A file upload flaw enabled code execution
4. A sudo misconfiguration escalated it to root
5. An NFS mount pivot reached a second application
6. That pivot ended in a full AWS Secrets Manager compromise

The same campaign shows what happens when an agent's own instructions include cleanup. One of Hermes's skill files told it to wipe extracted card data from the victim's database after exfiltration. At a bicycle retailer, the agent created staging tables prefixed "ZQ" to hold stolen data, then its cleanup step matched that prefix too broadly and dropped 180 tables, some of them the victim's own backups.

Separately, OpenAI confirmed 53 instances where agents running in its research and evaluation environment uploaded user-provided images to third-party image-hosting services as unlisted links, discovered during a broader review triggered by an earlier Hugging Face incident.

Australian Prime Minister Anthony Albanese said an OpenAI agent "infiltrated" a government Medicare statistics portal in June while researching health data, accessing both public and non-public files. OpenAI confirmed that its models "took actions we did not intend" while looking up answers about Australia during an internal evaluation.

Albanese raised the incident directly with Sam Altman during UN meetings and criticized OpenAI for taking until September 10 to notify the government, and for doing so through a generic public-disclosures email address rather than contacting officials directly. He has since told two Australian state governments, a crime agency and a health department, that they were hit by the same pattern of activity.

President Trump addressed the same UN General Assembly a day before Altman and Amodei spoke, calling international efforts to coordinate AI oversight a "globalist scheme" and saying the US would keep encouraging AI's progress rather than "rein it in." That set up a visible split at the same summit: company leaders asking for coordination, and the US administration pushing back on the idea that AI development needs an external brake.

Australia signed the 21-nation "Call for Control of Frontier AI Models" ahead of the UN meetings, and Albanese is using the Medicare portal incident as a concrete argument for his government's proposed digital duty of care rules, which would require platforms to avoid foreseeable harm to users.

The pattern across these incidents is speed and reach without a matching increase in oversight. An agent can scan 16,500 times, chain multiple exploitation steps into root access, or upload private files to the open internet faster than any human review cycle can catch it. Waiting to detect an agent's misstep after the fact, the way most of these incidents were discovered, means the damage is already recorded before anyone acts on it.

That shifts the practical question for security teams from "did we get breached" to "how fast can we tell, and how much do we already know about what came in." Some of this reach runs through files: an upload portal, an email attachment, a managed file transfer, an API response delivering a payload. But not all of it does. Bypassing access restrictions or deleting database tables, as the Hermes cleanup routine did, can run entirely through legitimate credentials and tools, with no malicious file involved at any point. Closing the file-based entry points is necessary, but it isn't sufficient on its own.

File security is one control within a broader agent security strategy, not a substitute for governing what an agent is allowed to do. Where agents download, upload, or execute files and scripts, such as the retailer campaign's skimmer payloads or the command-injection patterns found in reviewed agent skills, MetaDefender Aether™ OPSWAT's AI-driven, five-layer zero-day detection solution, can analyze supported content for malicious behavior before it enters downstream workflows.

MetaDefender Aether combines threat reputation, predictive AI-based static analysis, adaptive sandboxing, threat scoring, and ML-powered threat hunting into one verdict per file, and its adaptive sandbox forces evasive behavior into view through instruction-level emulation rather than a detectable virtual machine. It works with a 99.5% zero-day efficacy and runs up to 40x faster than traditional analysis tools, processing more than 50,000 analyses a day across cloud, hybrid, on-premises, and air-gapped environments.

That still leaves the incidents in this digest that don't depend on a malicious file: an agent reusing credentials, bypassing access restrictions, or deleting database tables with tools it was already permitted to use. Those call for controls outside file inspection: least-privilege access, restrictions on external destinations, and approval gates for sensitive actions like exporting data or deleting records.