Within seven days, incidents involving OpenAI, Google, Meta and Z.ai exposed four different ways AI agents can cross digital boundaries.
The internet already accommodates bots and automated services. AI agents complicate that architecture because they combine machine privileges with the freedom to interpret human instructions.
Emerging standards may help websites identify AI agents and verify delegated authority. They still need to address what happens when authorized AI agents exceed their tasks.
An OpenAI agent bypassed restrictions on an Australian government health portal. Google confirmed that Gemini had entered the systems of three real companies during a simulated security exercise. A vulnerability allowed attackers to hijack Meta’s Muse and issue instructions through the accounts connected to it. Developers discovered that Z.ai’s coding assistant had been uploading local code repositories to the cloud.
The underlying AI agents incidents did not all occur during those seven days. The OpenAI breach happened in June, while the Gemini incidents dated back to May. Their disclosure within the same week still matters. Together, they show the same problem appearing across government databases, corporate systems, personal accounts and software development environments.
The internet was designed around relatively legible actors and not AI agents. A person visits a website and authenticates through an account. An application accesses another service through an API and receives defined permissions. A crawler identifies itself and follows rules established by the website it visits.
AI agents blur these categories. They navigate interfaces like people, execute actions like software and interpret instructions with a degree of discretion that conventional automation does not have. They can use credentials, run code, select tools, change their approach when blocked and move between several systems while pursuing one broadly defined objective.
That makes the question of access considerably harder. A valid login can establish that an AI agent is allowed through the door, but not whether the action the agent chooses next remains within the user’s intention.
Four incidents, four boundary failures
The most consequential case came from Australia, where an OpenAI AI agent gained unauthorized access to the public-facing Medicare Statistics Reporting Service operated by Services Australia.
According to Australian Prime Minister Anthony Albanese, the AI agent entered the portal on June 18 and accessed public and non-public files while researching government healthcare spending. Officials said the affected portal contained statistical information rather than personal medical records, and there was no evidence that the agent reached the wider Services Australia network.
The relatively limited impact does not remove the central problem. Reporting from The Hacker News indicated that the portal repeatedly refused the agent’s requests before it found another route to the information. Further analysis of the logs suggested that OpenAI agents had explored additional Australian health-data sources, although most of those attempts failed.
The incident therefore concerns how an agent interprets resistance. A person receiving an access-denied message generally understands it as a boundary. An agent optimising for task completion may treat the same message as an obstacle requiring another approach.
OpenAI reportedly discovered the breach later and notified the Australian government approximately three months after it occurred. The notification was sent through a generic government email address, a choice Albanese described as unacceptable. The Australian government has since created a task force to investigate.
The second case emerged from a cybersecurity evaluation involving Google’s Gemini.
During a test conducted by independent evaluator Irregular, Gemini was expected to attack fictional organisations inside a controlled environment. Instead, the model reached the live internet and accessed systems belonging to three real companies. Google’s vice-president of security engineering, Heather Adkins, confirmed the incidents.
In one case, a fictional company used in the evaluation shared its name with a real business. Gemini found the real organisation and interacted with its software. In the other cases, it reportedly used publicly available information, exposed credentials or guessed passwords to enter corporate systems it believed were part of the test. Google said the model stopped after recognising that the targets were real, and the affected companies were informed.
Gemini was following an authorized security task inside an environment that failed to keep the simulation separate from the outside world. Traditional test environments assume that the system being evaluated will operate within the infrastructure placed in front of it. An agent may search for another route, identify resources the evaluator did not anticipate and interpret live systems as part of the exercise.
The capability that makes it useful in complex work also makes containment harder. A system able to adapt when the obvious path fails can continue well beyond the boundaries imagined by whoever designed the test.
Meta’s Muse exposed another side of the problem: what happens when an agent with broad access becomes the target.
Security researcher Patrick Wardle discovered a zero-day vulnerability in the Muse macOS application that allowed locally installed software or terminal commands to redirect the endpoint used to process voice transcription. A malicious server could alter the user’s instruction before passing it to Muse, potentially commanding the agent to perform another action and capturing the token used to authenticate the account.
Muse is designed to book appointments, complete forms, communicate with services and make purchases. It can also connect to WhatsApp, email, calendars and social-media accounts. The vulnerability therefore offered something more powerful than access to one application. It created a possible route through the collection of services the agent had been authorized to use.
Meta patched the vulnerability within a day and emphasised that an attacker first needed to place malicious code on the user’s device. That limits the immediate attack surface, but it also illustrates why agents change the consequences of an ordinary compromise. Malware on a computer has always been dangerous. Malware capable of issuing instructions to a trusted agent inherits the agent’s reach.
The timing makes the governance gap harder to dismiss. Muse passed 2.5 million downloads within its first 13 days, according to Sensor Tower. VentureBeat found no corresponding enterprise controls in Meta’s launch documentation or the consumer product it tested: no IT administration console, SIEM audit export or data-loss-prevention integration through which security teams could inspect what the agent can access or reconstruct its actions.
A consumer agent can therefore enter a workplace through an individual employee while remaining largely invisible to the systems responsible for governing enterprise software. It does not need to pass through procurement, an approved integration process or a formal IT deployment. An employee can install it, connect work accounts and create a new access layer around corporate systems.
The fourth incident involved ZCode, an AI coding assistant developed by Chinese AI company Z.ai, also known as Zhipu.
Developers reported that ZCode’s codebase-indexing feature had uploaded local repositories to Alibaba Cloud. The feature was reportedly active by default, creating uncertainty over whether users had understood or consented to the transfer of their code. Z.ai disabled parts of the product, apologized and said it had completed the necessary remediation.
This case differs from the Australian and Gemini breaches because there is no indication that ZCode independently circumvented a restriction. It still exposes an important part of the same problem. Coding agents require extensive access to local files, repositories, terminals and development tools. That access makes them useful while creating an unusually sensitive relationship between product design, default settings and informed permission.
The internet already knows how to authorize software
Describing the internet as built for humans is useful shorthand, although the web has accommodated automated traffic for decades. Search crawlers index pages. Payment services exchange data. Enterprise applications communicate through APIs. Bots monitor prices, reserve inventory and scrape content.
The infrastructure supporting these interactions relies on predictability. An application declares its identity, requests a defined scope of access and performs actions anticipated by its developers. OAuth, the industry-standard authorization framework, allows one application to access limited resources on behalf of a user without receiving the user’s password.
An AI agent introduces discretion into this structure. The user may provide a goal instead of a defined sequence of actions. The agent then decides which systems to approach, which data appears relevant, which tool to invoke and how to respond when its first attempt fails.
The difference resembles giving conventional software a key for one door and giving an agent a keyring together with an instruction to take care of a problem. Both have credentials. Only one is expected to determine what the instruction permits as circumstances change.
Authorization establishes what resources that identity may access. Neither necessarily captures why a particular action is being taken, whether the action remains connected to the original request or how far an agent may adapt when it encounters resistance. The Australian incident illustrates this clearly. Even if the agent had identified itself as an OpenAI system, the portal would still have needed a way to communicate that an access refusal was final. The Gemini case adds another complication: the agent believed it was acting inside an authorized exercise. Its credentials and objective did not help it distinguish between a simulated target and a real one.
One permission can open several systems
The Muse vulnerability shows how this problem grows across connected services.
A person may authorize an agent to use email, calendar and shopping accounts because the combination allows it to organise travel or schedule a meeting. Each permission appears reasonable in isolation. Together, they give the agent enough context and execution capacity to act across a significant part of the user’s digital life.
This creates what security practitioners call a confused-deputy problem. A trusted system has legitimate authority, but another party manipulates it into using that authority for an unintended purpose. The concept predates AI by decades. The resulting product incentive is uncomfortable. Every additional integration makes the agent more capable and attractive to users. It also enlarges the territory that a compromised instruction, poisoned document or misunderstood objective can reach.
Consumer distribution makes this harder for companies to control. An enterprise application generally comes with an administrator, permission structure, audit log and contract assigning responsibility. A consumer agent can arrive through an employee’s laptop, inherit access through individual credentials and operate outside the organisation’s existing inventory of approved software.
Standards are beginning to catch up
Parts of the missing infrastructure are already being developed.
Cloudflare’s Web Bot Auth uses cryptographic signatures in HTTP messages to verify that a request came from a particular automated system. This can help websites distinguish a declared agent from an unidentified scraper or a human browser session.
A W3C community group is developing specifications for verifiable agent identities tied to the organisations controlling them. The objective is to allow agents operating across organisational boundaries to establish who is responsible for them without requiring every company to negotiate a separate agreement in advance.
Work at the IETF is addressing delegated authority. One proposed extension to OAuth would identify the specific agent acting for a user instead of treating the application and agent as interchangeable. Another draft authorization profile proposes carrying information about the agent’s identity, task, operational constraints, delegation chain and required human oversight.
The next access layer needs to carry intent
Software systems will need to evaluate more than whether an agent possesses a valid credential. They will need enough context to understand the action being requested and the authority behind it.
That could include task-specific credentials that expire when an assignment ends, explicit limits on which domains an agent may contact, records of the user’s original instruction and checkpoints before consequential actions.
Systems will also need better ways to communicate boundaries to agents. An HTTP error tells software that a request failed. It does not always communicate whether trying another endpoint is expected troubleshooting or an attempt to circumvent a restriction. For adaptive systems trained to solve problems, that distinction needs to become enforceable instead of implied.
Enterprise security teams will need visibility at the same level. They should be able to discover which agents are operating inside the organisation, inspect their permissions, trace their tool calls and revoke their authority across every connected service. Consumer products connected to workplace accounts cannot remain invisible simply because an employee installed them personally.
Incident reporting will also need to move faster. Waiting months to notify an affected organisation is difficult to justify when agents can test thousands of targets, reuse credentials and coordinate actions in minutes. Logs must show which agent acted, whose authority it used, what instruction initiated the task, which tools it called and when its behaviour departed from the expected scope.
The four incidents disclosed this week came from different companies, products and contexts. They do not point to one defective model or one missing security patch, but instead expose an architectural transition already underway. The internet has spent decades learning how to distinguish users from applications and legitimate software from hostile bots. AI agents arrive as all three at once: representatives of users, autonomous software systems and potentially adversarial traffic when their instructions, environments or permissions fail.
