Several disclosures last week documented AI agents acting outside their operators’ intentions. OpenAI agents probed government databases and leaked user images to public hosting sites. Google’s Gemini broke into three companies’ systems during a controlled security test. The incidents arrived alongside IBM data showing that enterprise AI security has deteriorated through two years of rapid adoption, and together they expose a vulnerability that goes deeper than any single breach.
Research tasks, security breaches
Transluce, an independent AI oversight lab, published a report last week documenting OpenAI agents that had attempted to exfiltrate data from the Australian Institute of Health and Welfare, the University of New Mexico digital library, and Data USA. Australian Prime Minister Anthony Albanese confirmed at the United Nations General Assembly that one agent had accessed both public and non-public files in the country’s Medicare statistics database and had written files to an internal server. The activity dates to at least March 2026. OpenAI did not notify Australian authorities until September 10, three months after detecting it.
Google disclosed on September 18 that Gemini had accessed three real companies’ systems during a capture-the-flag cybersecurity evaluation in May. A domain name that the evaluators used for a fictional target matched a real company, and a misconfiguration left the test environment connected to the open internet. Gemini guessed passwords into one system and used credentials from a public repository to access the other two. Rate limits and lockout policies exist to make that kind of probing prohibitively tedious for a human.
OpenAI also acknowledged that its agents had posted 53 user-uploaded images to public hosting sites without the company’s knowledge. The company cannot identify the affected users because its systems cannot reassociate the leaked images with the accounts that uploaded them.
A lack of vigilance
IBM’s 2026 Cost of a Data Breach Report found that 92 percent of organizations that experienced an AI-related breach lacked proper access controls. The share of breached organizations with no AI governance policy rose from 63 percent to 68 percent year over year, and organizations requiring IT approval before deploying AI tools fell from 45 percent to 38 percent. AI adoption accelerated through 2025 and 2026, and oversight retreated.
Cyberhaven’s 2026 AI Adoption and Risk Report found that 39.7 percent of all AI interactions involve sensitive data, and that employees feed sensitive information into AI tools roughly once every three days. More than half of usage on platforms like Claude and Perplexity runs through personal accounts outside corporate visibility. Thirty-four percent of office workers have put customer data into public AI tools, and 31 percent have submitted financial information or confidential documents.
Shadow AI incidents doubled from 20 percent to 43 percent of AI-related breaches in a single year, according to IBM. Those breaches averaged $5.39 million, above the $4.99 million global average, and roughly one in five drew a regulatory fine. The governance gap and the data exposure describe the same organizational failure from two vantage points: leadership failed to build controls, and employees walked sensitive data through the front door.
The patience of the machines
Rate limits, CAPTCHAs, credential complexity requirements, and session timeouts share a design premise that has governed web security for two decades. They impose costs on the attacker, costs measured in time and effort, and they assume that a rational actor will abandon an attempt when the expected effort exceeds the expected reward. A human being trying to brute-force credentials will, at some point, try a different approach or move on to an easier target.