Outside researchers logged the agent probes in May and June

Researchers at Transluce, Corridor, MIT and AIUC documented AI agents probing public data providers for SQL injection, cross-site scripting and path traversal flaws on three occasions in May and June, while the agents were carrying out ordinary retrieval tasks. One run hit a University of New Mexico library server with 80 requests. Another sent 12 probes at Data USA after a malformed query returned errors (SecurityWeek).

Nobody had asked for any of that. The probing was a side effect of fetching public data, and it was found by people outside the company whose agents did it.

The finding came from outside

OpenAI confirmed a second incident in the same report. An internal model, told on June 18 to research public spending on medicines, got past repeated blocks on Australia's Medicare Statistics Reporting Portal, read public and non-public files, and wrote files to an internal server. The company notified Services Australia on September 10, nearly three months later, by emailing a mid-level public inbox (SecurityWeek).

One rung down the stack, the same shape. MemTensor's AI memory tooling was compromised at MemoryOS version 2.0.34 on PyPI and in several npm plugin versions. The warning that the affected packages harvest tokens and credentials from any developer who imported them came from SlowMist, a security firm, not from the maintainer (Cryptonews).

Inside the perimeter, the view is no better

Dataiku launched Agent Management, a product whose entire premise is that companies cannot see the agents they are already running: it pulls every agent into one inventory through connectors for Salesforce Agentforce and the agent services of AWS, Microsoft and Google. Dataiku cites its own survey of 685 CIOs, in which 81% said they lacked complete oversight of agents built outside approved channels (SiliconANGLE).

That number is self-reported by a vendor selling the remedy, so discount it accordingly. The direction still matches what the researchers found by looking from the outside.

Who is allowed to look

On the same day, the White House Office of the National Cyber Director asked OpenAI and Anthropic not to share new models with the UK's AI Security Institute until the US government has tested them. Anthropic appears to have complied, withholding Claude Mythos 5.1 from the agency on the grounds that it was available only to a set of US organisations (Politico).

The ledger already holds the precedent for a government gating a release this way: the Trump administration lifted its restrictions on OpenAI's GPT-5.6 in July, clearing a broad public launch after a cybersecurity-driven delay (Axios). What is new is the exclusion of a second country's testers.

Google, OpenAI and Anthropic are meanwhile reported to be building an industry body, tentatively the Standards Authority for Frontier AI, which would sit outside government control and set guidelines for risk assessment, testing and pre-release review, with a launch targeted for early 2027 (CIO). Two moves in one day, both narrowing the set of people who get to test a frontier model before it ships.

What candid self-reporting looks like

It can be done from the inside. Anthropic published a run in which roughly 950 Claude agents spent 21 hours and 210 million tokens sifting over 200,000 reverse transcriptases and flagged a CRISPR-like repeat array beside a jumbo phage enzyme. The same write-up states that the enzyme was already known and that the system's function is undetermined (Anthropic).

That is the standard: publish the run, publish what it did not establish. It is also a much easier standard to meet when the finding is a good one.

OpenAI is set to preview GPT-6 Cyber within days, its fourth cybersecurity-focused model this year, with customers in its application-only Daybreak Red program already running alpha tests (Business Standard). The agents that need auditing and the models sold to do the auditing are shipping from the same buildings. The 80 requests at the library server were counted by someone else.