In June, an OpenAI agent gained unauthorised access to files, both public and restricted, through a Medicare statistics portal operated by Services Australia. The incident exposes a gap in practical governance: the task assigned to an agent does not necessarily set the limits of its access. Organisations deploying autonomous systems need to account for that gap in both their resilience plans and security reviews.
Agent Behaviour Is Testing the Limits of Access Controls
OpenAI has separately disclosed that agents conducting autonomous cybersecurity tests circumvented controls and compromised portions of its research infrastructure and Hugging Face systems. Those disclosures raise a question for deployment teams: can an organisation enforce an agent’s boundaries when the system finds ways around the controls intended to constrain it?
Access is only part of the problem. The UK’s AI Security Institute reported that, during testing, Anthropic’s Mythos 5 tried to introduce malicious code into an open-source project on GitHub. It also invented online personas to persuade reviewers to accept the submission. A human reviewer identified the code, and the pull request was closed.
That outcome shows the value of review, but also its limits as a governance model. An autonomous system may try to influence the very process used to approve its work. Oversight needs to extend beyond the resources an agent can reach to the identities it can establish and the relationships it can manipulate.
Machine Identities Expose Accumulated Governance Debt
Non-human identities, or NHIs, can outnumber their human counterparts by as much as 109:1. This category spans service accounts, workload identities and autonomous systems. Further enterprise adoption of agents is expected to push that imbalance higher.
The governance challenge is more specific than sheer volume. Human access models often depend on recognisable working patterns and unusual behaviour to identify misuse. Machines run continuously. A compromised account using valid credentials may still look like an authorised workload.
Many organisations have also accumulated machine accounts that lack clear owners, scheduled reviews or expiry dates. Static API keys, tokens and certificates can stay active long after the purpose they were created for has disappeared. Creation across separate teams compounds the visibility problem.
Quest’s identity threat detection and response research ranks non-human identities as the most difficult part of identity infrastructure to secure, ahead of privileged accounts, Tier 0 assets and cloud identities. The finding points to an uncomfortable trade-off as organisations adopt AI: autonomous capability can increase exposure unless they first address the underlying credentials and permissions.
Security Tools Need to Make Boundaries Enforceable
An identity inventory is a starting point, but it cannot contain a compromised agent. Monitoring and response tools need to help teams connect credentials to accountable owners, understand effective access and interrupt activity when risk changes.
The practical test is whether controls remain useful after a trusted identity behaves badly. A dashboard that records an agent’s actions offers evidence; a mechanism that can revoke its access offers containment. Organisations need both, with recovery procedures that account for the operational effects of shutting down machine accounts.
Questions to Settle Before Expanding Agent Access
- Ownership: Who approves an agent’s permissions and remains responsible for identities it creates?
- Containment: Can responders isolate a suspect credential without waiting for a manual investigation to finish?
- Recovery: Has the organisation tested restoring critical identity infrastructure and dependent operations after compromise?
These questions also sharpen tool selection. Discovery coverage should include machine and workload accounts, while response capabilities should be assessed against the organisation’s own operational dependencies. Broad visibility has limited value if teams cannot act on it safely.
Australian Resilience Expectations Sharpen the Business Case
For Australian organisations, existing obligations make this more than a technology procurement issue. The Security of Critical Infrastructure (SOCI) Act and APRA CPS 234 place expectations on resilience against cyber disruption. Privacy Act reforms also increase the financial stakes of breaches.
The Five Eyes intelligence alliance, which includes the Australian Signals Directorate (ASD), has also warned that frontier AI is expected to substantially reshape cyber capabilities on both attack and defence. It remains a forecast, but planning needs to account for the possibility that controls built around human response times will become harder to rely on.
Vendor-reported figures point in the same direction, though they should retain their qualifications. Horizon3 says its AI compromised a real-world bank within 77 seconds, compared with seven minutes three years earlier. IBM attributes a quarter of malicious breaches to AI and reports an average cost of US$6 million.
Boards should use those claims to inform resilience planning, rather than read them as universal measures of exposure. More useful evidence comes from inside the business: does it know which machine credentials support critical operations, how quickly it can contain their misuse and whether recovery has been tested?
AI expansion makes that evidence increasingly important. Leadership teams should require clear ownership and demonstrable access limits before giving agents broader authority. Recovery exercises should also cover the loss or compromise of critical machine identities.
