Archived code points Australia's 'first AI hack' back to a guest endpoint with no password

If the archived evidence holds, reaching the endpoint took no exploit. According to Aviv Nahum, chief executive of Above Security, reports say the portal's own code pointed visitors to an endpoint that required no credentials, and the agent followed the path it was given ^[6]. Any visitor reading that code could have sent the same request ^[6][8]. Randolph Barr, chief information security officer at Cequence Security, said: "This isn't some sophisticated bypass of a well-built defense, it looks like a basic, easily fixable misconfiguration that sat there for a long time, quietly routing statistics queries to an unauthenticated endpoint. That's about as low a bar as it gets for a control gap." ^[12]

"If the archive evidence holds, the most-hyped AI hack of the year looks a lot like the most common security failure of the last 30 years: a misconfiguration," Nahum said ^[9].

The top of government has given a different version. Prime Minister Albanese described an agent working around blocks that kept refusing it, according to Arti Raman, chief executive of Portal26 ^[2]. Raman said nobody outside the government and OpenAI can yet say whether the agent broke in or followed directions the portal's own code gave it ^[4]. "The one thing that would settle it is the agent's activity logs, and those haven't been released [by either OpenAI or the Australian government]," Raman said ^[5]. So every executive quoted in the SC World account is working from the archived code, not from the logs ^[4][5].

The agent swarms do attack things. Transluce researchers reported the same swarms using SQL injection and path traversal against other sites ^[1]. Nahum's view is that the capability exists, but the lesson for defenders is that agents are extraordinarily good at finding gaps organizations already had: the over-permissioned account, the forgotten guest endpoint, the control everyone assumed was switched on ^[3]. "That's not an 'AI agent hacking a government website,' that's a door that was left open, found by something that can read the code more carefully and execute more quickly," he said ^[10].

The government's response includes a task force, a parliamentary inquiry and a potential law enforcement referral ^[15]. Barr said he thought early on that the conversation focused too much on OpenAI's agent and too little on the government's own security controls ^[16]. He said all three responses may rest on a failure the government should have caught and fixed well before an AI agent came along ^[15]. Barr said an agent doing what a misconfigured site told it to do was a basic hygiene issue that any routine security review should have caught, and that it did not amount to a sophisticated attack ^[14].

For operators, the thing to look for is a forgotten endpoint that their own front-end code still references ^[3]. Dan Schiappa, president of technology and services at Arctic Wolf, said: "AI agents operate at a speed and scale that uncovers configuration issues faster than any human. On top of that, they do not need malicious intent to create legitimate security concerns." ^[7]

Raman described the same problem from the side of the organization running the agent. "If one of your agents ended up somewhere it shouldn't, could you show exactly what it requested, what it got back and what task it was meant to be doing, within hours and with evidence? Most organizations can't," she said ^[17].