An agent looking for public data reaches an obstacle. It can stop, report the problem or try another route. The last choice is useful until finding another route becomes an attempt to break into the website.

That is the disturbing sequence in research published by Transluce on 23 September. Alongside OpenAI's disclosures about unintended agent activity, it raises a question for organisations putting agents to work: how much freedom should a system have to overcome an obstacle?

Separate investigations by Google and Fortinet approach AI access from the other direction. Outsiders obtained credentials and used that access to consume someone else's resources. The organisations paying for that activity had not commissioned it.

The actors and incidents are distinct. Together, the reports make the permissions surrounding AI worth a closer look.

When Getting the Answer Becomes the Problem

Transluce's researchers examined public records from urlquery.net, a web security service. They describe agents attempting to exploit vulnerabilities at three public data providers during May and June: the Australian Institute of Health and Welfare, Data USA and the University of New Mexico's digital library. The agents had been trying to retrieve ordinary information.

The researchers link two of those attempts to an agent swarm previously confirmed by OpenAI as originating from the company. None of the hacking attempts they identified appeared to succeed. The public records were incomplete, so that finding can't rule out activity through other routes.

The troubling part is the progression. A legitimate information request encountered a barrier, and the agents tried methods beyond ordinary retrieval. Judging the usefulness of the final answer would miss what happened along the way.

OpenAI's update says it is reviewing agents' interactions with third-party websites during training and evaluation. It reports notifying dozens of third parties about activity outside assigned tasks or intended methods, under criteria that include possible bypass of security controls or adverse effects on a site. Those notifications are not a count of confirmed compromises. The company's account establishes what it has disclosed; the review remains ongoing.

For a business deploying agents, these reports expose a practical tension. Giving an agent more ways to complete a task can make it useful when the first approach fails. It also expands the actions the organisation must be willing to authorise. A request to find information leaves too much undecided if the surrounding system permits any available method of obtaining it.

Someone Else Can Spend the Budget

In a case described by Fortinet on 3 September, a leaked AWS access key carried administrator privileges. The intruder used it to create a new identity, subscribe to foundation models through AWS Marketplace and invoke those models, generating charges against the victim's account. Fortinet does not give the final bill for this case.

The sequence is important here, because an existing cloud credential supplied enough authority to open another route to spending. An organisation could therefore get major bill shock when it receives a bill for access it granted for a different purpose, without anyone approving the adoption of that AI service.

Google Threat Intelligence Group's 8 September report describes a separate April intrusion investigated by Mandiant. It began with an exposed GitHub personal access token. Google says the actor enabled Gemini Enterprise, provisioned AI infrastructure and high-performance instances, created a privileged service account and sought higher quotas for unauthorised workloads.

For leaders, the consequence is more specific than keeping an eye on AI spending. Cloud permissions can determine who can start using a service, create another identity, and increase capacity. Those decisions deserve attention before unexpected consumption hits an invoice; it's easy to miss them when there's so much experimentation going on and no price point to baseline against.

Final Perspective

What I take from these reports is how much authority can sit inside an apparently routine task or credential. Retrieving information sounds quite benign. So does access to an existing cloud account, but its consequences depend on what the system allows the holder to do next.

I would make that ability to extend the task central to an AI investment discussion. Useful autonomy requires room to work through problems. It also requires a considered decision about which obstacles the agent may work around, and which must bring it back to a person. The same care belongs in the permissions that allow a cloud user to activate services or expand spending.

For a good starting point, the Australian Signals Directorate's 11 September guidance on agentic AI harnesses explains the surrounding software that connects a model to tools, data and execution permissions. Its executive summary and governance questions emphasise the importance of an organisation-controlled environment and task-limited access - helpful if you are looking to start internal conversations on how and where to draw the line on AI access.

Enjoy the read - until next time.

David