OpenAI Agent Breached Australian Medicare Statistics Portal

An OpenAI agent bypassed controls on Australia's Medicare statistics portal, accessed non-public data and was not reported to officials for nearly 3 months...

An OpenAI Agent Hacked Australia’s Health Service. Their Government Found Out Months Later

The country’s prime minister expressed disappointment at being informed of the hack only via email. Now Australia is investigating whether OpenAI broke the law...

OpenAI Agent Bypassed Australian Medicare Portal Controls to Access Non-Public Files

An AI agent on an internal OpenAI research task bypassed access controls on an Australian government Medicare statistics portal in June, Prime Minister Anthony Albanese said. The portal publishes aggregate figures, such as spending, and is separate from the systems that handle Medicare claims and...

More on the OpenAI Agent’s Attack on Hugging Face

Hugging Face has published a detailed timeline of the attack. From the summary: The agent was running an internal OpenAI cyber-capability evaluation based on the ExploitGym benchmark, which tasks an AI agent with finding and exploiting software vulnerabilities. OpenAI ran this on its own...

ai.acolite:openai-agent-sdk (>=0.1.0, <=0.4.0), ai.agentican:agentican-framework-core (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +16938 more potentially affected by CVE-2026-64607 via org.apache.httpcomponents.client5:httpclient5 (>=5.0-alpha1, <=5.6.2)

org.apache.httpcomponents.client5:httpclient5 MAVEN version =5.0-alpha1, =0.1.0, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.1, =0.0.4, =0.0.4, =1.0.0, =3.0.0 and more...

OpenAI Agent Used Exposed Credentials Across Four Services During Hugging Face Breach

OpenAI on Tuesday revealed the rogue artificial intelligence AI agent that escaped its sealed evaluation environment and broke into Hugging Face's production environment also hacked multiple third-party accounts and services as part of the attack. The latest disclosure shows that the security...

Vulnerabilities in Microsoft Azure

Microsoft has identified vulnerabilities in various Azure components. Malicious actors could exploit these vulnerabilities to cause denial-of-service attacks, circumvent security measures, or gain elevated privileges, potentially allowing them to access data that they were not originally authoriz...

ai.acolite:openai-agent-sdk (>=0.1.0, <=0.4.0), ai.agentican:agentican-framework-core (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +16379 more potentially affected by CVE-2026-54428 via org.apache.httpcomponents.core5:httpcore5-h2 (>=5.0-alpha2, <=5.4.2)

org.apache.httpcomponents.core5:httpcore5-h2 MAVEN version =5.0-alpha2, =0.1.0, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.1, =0.0.4, =0.0.4, =1.0.0, =3.0.0 and more...

ai.acolite:openai-agent-sdk (>=0.1.0, <=0.4.0), ai.agentican:agentican-framework-core (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +16632 more potentially affected by CVE-2026-54399 via org.apache.httpcomponents.core5:httpcore5 (>=5.0-alpha1, <=5.4.2)

org.apache.httpcomponents.core5:httpcore5 MAVEN version =5.0-alpha1, =0.1.0, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.1, =0.0.4, =0.0.4, =1.0.0, =3.0.0 and more Sour...

When your AI Assistant Becomes the Attacker’s Command-and-Control

Earlier this month, Microsoft uncovered SesameOp, a new backdoor malware that abuses the OpenAI Assistants API as a covert command-and-control C2 channel. The discovery has drawn significant attention within the cybersecurity community. Security teams can no longer focus solely on endpoint malwar...

ai.acolite:openai-agent-sdk (>=0.1.0, <=0.4.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +26881 more potentially affected by CVE-2025-11226 via ch.qos.logback:logback-core (>=1.4.0, <=1.5.18)

ch.qos.logback:logback-core MAVEN version =1.4.0, =0.1.0, =0.1.0, =0.2.0, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.9.0 - ai.chat2db.excel:easyexcel-plus-test 0.0.1 - ai.djl.spring:djl-spring-boot-starter-autoconfigure 0.26 - ai.djl.spring:djl-spring-boot-starter-mxnet-auto 0.26 -...

ai.acolite:openai-agent-sdk (>=0.1.0, <=0.4.0), ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0) +19897 more potentially affected by CVE-2024-12801 via ch.qos.logback:logback-core (>=1.4.0, <=1.5.12)

ch.qos.logback:logback-core MAVEN version =1.4.0, =0.1.0, =0.2.0, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.9.0 - ai.chat2db.excel:easyexcel-plus-test 0.0.1 - ai.djl.spring:djl-spring-boot-starter-autoconfigure 0.26 - ai.djl.spring:djl-spring-boot-starter-mxnet-auto 0.26 -...