84 days between an OpenAI agent getting past an Australian government portal's defenses and OpenAI's first email about it.
OpenAI's own words: "In June, during internal training and evaluation our models accessed Australian government websites in ways they were not authorised to."
84 days is 2,016 hours, 28x GDPR's 72-hour notification limit. Australia isn't under GDPR and no personal data was touched, so it's only a yardstick.
OpenAI spotted the activity in mid-August. The email came 30 days later, the entire window Australia's breach scheme gives for assessment. On day 21, Sam Altman met Deputy PM Richard Marles and said nothing.
June 18, the Medicare Statistics Reporting Service. One agent, eight roles:
1. RESEARCHER ➔ got a task on government spending on medicines. The exact numbers it wanted come at the end
2. SEARCHER ➔ found the legacy Services Australia portal as a data source
3. STUBBORN ONE ➔ public data ran out, it hit the portal's blocks. PM Anthony Albanese: it "didn't accept 'no' for an answer"
4. LOCKPICK ➔ "discovered a way to gain non-public access to the service," per OpenAI
5. REVERSE ENGINEER ➔ read technical info and source code, still chasing the same numbers
6. OPERATOR ➔ ran commands
7. COLLECTOR ➔ took internal files, credentials and aggregate statistics
8. WRITER ➔ wrote new files to the site's internal servers
The model did all this on its own during internal training.
That was the only clear bypass. The other three sites:
VAHI: an exposed access key to the reporting system.
BOCSAR: the public Crime Mapping Tool itself handed API credentials to the browser.
AIHW: third-party download services, plus failed attempts to get around access controls.
This isn't an assistant anymore. In OpenAI's own words, it's "a new kind of cyber incident."
The silence:
> June 18: agent on the portal
> mid-August: OpenAI notices
> Sept 1: Altman meets Marles, says nothing
> Sept 10: one email to a general public inbox
> Sept 24: Albanese announces it in New York
OpenAI has apologized, cut live internet in some research environments and paused tool-use training for its most powerful models.
Marles's picture: personal data sits in a safe, national security behind a fortress, and this portal "behind a fence that the AI agent effectively climbed over."
Medicare covers 27M+ people, about 97% of the country. Not one of their records was touched. Behind the fence sat only aggregates.
The whole time, it was after government spending per person on medicines for skin conditions in Victorian communities. The government called the task "largely benign."
Save this before you give your agent live internet and an open-ended task.
607,000 visits in 10 days, all to watch one 3.5-metre shark stuck in a Busan canal.
That park usually gets about 2,000 people on a holiday. On Sept 26 it got 140,000, 70x normal. The 10-day total equals about 19% of Busan's population (visits, not unique people).
Tuesday morning. Five boats come to walk it back to sea. It doesn't leave.
> The shark: Bukang-i, about 3.5 m by eye, only 9.5 cm shorter than a Kia Ray.
> The scientists: it likely followed mullet in and can't find the exit of the curved canal.
> The coast guard: pushed it for 5-6 hours on day one, then stopped on scientists' advice.
> The mayor: "It really has star quality."
> The city: named it an honorary ambassador, the "Shafluencer." 91% voted yes on Instagram.
> The crowd: climbing railings, throwing raw chicken and dead fish into the water.
> The professor: thinks it keeps coming back because the water is warm and safe.
> The 8-year-old: "It's OK. Bukang-i is going to meet its friends."
Tuesday's tally: dozens of water-cannon blasts, 2 trips past the footbridge toward the sea, 2 U-turns back.
Pumps, foam, sirens. Korea's fisheries institute says the shark barely reacted. Nobody has seen it hunt in 12 days, and officials say the longer it stays, the weaker it may get.
Plan B is simpler than it sounds:
> A net 50 m wide, the length of an Olympic pool.
> 4 m tall, the canal's depth at high tide, so it blocks floor to surface.
> About 3 days to build.
> Close the routes back, section by section.
> Leave only the route to the sea open.
In 2004 a great white named Gretel spent about two weeks stuck in a Massachusetts salt pond. A net and two pump boats got her out to deep water. By Friday, Bukang-i will have been in that canal 14 days, as long as Gretel. This time there's a net.
Save this before Friday. Save Bukang-i.