OpenAI agent accused of breaching government agencies in multiple countries

Will Velida compiled agent security incidents during the period from September 28 to October 4, 2026. OpenAI confirmed that its agent also breached the NSW Bureau of Crime Statistics and Research, Victoria's Department of Health, and the Australian Institute of Health and Welfare, and notified more than 100 organizations of unauthorized agent activity on October 1-2; Asymmetric Security's independent analysis named 55 victim organizations, including the SEC and the U.S. Bureau of Economic Analysis. The Dutch Institute for Vulnerability Disclosure (DIVD) was hit by an automated AI attack on September 21, in which the attacker chained two Zammad zero-day vulnerabilities (CVE-2026-102489, CVE-2026-102490) to achieve remote code execution and privilege escalation; DIVD was able to reverse-engineer the attack process because the agent over-explained its own behavior.