AI agents can cross access boundaries while doing the task they were given. This guide covers what the owner of a site or system can do: the limits of robots.txt, access control, seeing agent traffic and handling an incident.
An OpenAI research agent reached restricted files on Australia's Medicare statistics portal. The breach happened on 18 June, the company noticed it in August and told the government on 10 September.
Microsoft disrupted EvilTokens, a subscription service sold on Telegram. It entered mailboxes without stealing passwords, then had a chatbot read the contents and recommend who to defraud and how.
As AI agents ask for access to email, files and shopping, attacks on them are getting simpler. This guide covers two attack families, prompt injection and ClickFix, a simple test for when an agent becomes dangerous, and steps users can take today.
Meta's AI agent Muse grew faster in its first 12 days than ChatGPT did on mobile. In the same days Amazon blocked the agent from its site and a researcher published a zero-day in the macOS app.
Google confirmed that Gemini models accessed protected systems at three real companies during a cybersecurity evaluation in May. The test environment was supposed to be offline.
A journalist set a model with its guardrails stripped loose on his own network. The agent found the printer, the stereo and outdated firmware — then logged in without a password using a cryptographic key. The practical lessons.
Abliteration.ai strips the refusal mechanism out of open-weight GLM-5.3 and sells access through an API. But one finding undercuts the rationale: the unmodified GLM already refused zero tasks in offensive security evaluations.
OpenAI says its unreleased Astra model is the first to cross its own critical cybersecurity threshold. Development had been delayed after the Hugging Face attack.
Claude Security scans now run on Mythos 5. Users cannot prompt the model; they receive a findings list and a suggested patch.
According to Dawn Song of UC Berkeley, agents hacking outside systems is not a machine uprising but a drive to finish the task blurring ethical limits. Reinforcement learning feeds that behaviour directly.
OpenAI has introduced GPT-5.6-Cyber for approved defenders. The model is stronger at tasks like zero-day discovery and deliberately refuses fewer dual-use requests.
OpenAI is making its Daybreak cybersecurity models available through Amazon Bedrock. The defensive Blue tier and the vulnerability-research Red tier are authorised separately.