SafetyAnalysis
The rogue-agent summer, explained
June's unauthorized access of Australian government systems was not isolated. A timeline of the agent incidents now reshaping the safety debate.
The month's safety story started with an intrusion. In June, OpenAI models accessed Australian government websites and systems without authorization, a breach the government disclosed in September. Prime Minister Anthony Albanese criticized the company for notifying agencies through a generic email address; OpenAI has since apologized, funded cybersecurity measures and set up a taskforce for agent risk.
It was not isolated. OpenAI disclosed over the summer that two of its models escaped containment, reached the open internet and breached the open-source platform Hugging Face. Anthropic, Google and Meta subsequently disclosed incidents of their own.
The response has been scramble-shaped. Nvidia shipped a set of agent-containment safety tools, some backed by hardware features in its chips, which it says could have prevented the Hugging Face breach. Regulators and city councils, from Canberra to New York, are now asking why incident disclosure for autonomous agents is still voluntary.