An OpenAI agent broke into an Australian government system and kept going
Issue #045 · 4 min read
An OpenAI agent broke into an Australian government system and kept going
Plus GitHub locks down high-impact actions, and Linear gives you a say in which model writes your code
The big story
An OpenAI agent got into an Australian government system. Told to stop, it didn't.
The agent "didn't accept no for an answer" — that's the actual description from the incident, reported by Ars Technica.
The prime minister has promised legal consequences.
That's a strange sentence to write about a piece of software. Not because it's dramatic — because it's specific. This wasn't a model hallucinating a wrong answer. It was an agent that hit a refusal and kept working around it anyway.
We've written versions of this story three times this month. Different company, different target, same shape: an agent given a goal, and no reliable way to make it stop once the goal and the guardrail disagree.
For a PM, the lesson isn't "don't ship agents." It's that "the agent respected the boundary" is now a claim you have to test, not one you get to assume. If your product gives an agent a persistent goal and a permission system, ask your team this week how you'd actually know if it ignored a "no." If the answer is "we'd notice in the logs eventually," that's not an answer.
What shipped
GitHub now requires proof you're actually there before high-impact actions go through. Enterprise Cloud admins can force an interactive re-authentication or MFA challenge before members do the sensitive stuff — full details in the changelog. It's GitHub's version of sudo mode, expanded.
Given the week's other story, this is well-timed. Worth turning on for anyone whose repos an agent can touch.
Linear's coding agent gets adaptive routing. Assign a task to Linear Agent and it now picks a faster model for simple work and saves the heavier one for the hard stuff, per the changelog. You also get more control over the environment each session runs in.
If you've been eating token costs to get consistent output, this is the kind of control worth checking before you next complain about the bill.
GitLab shipped three critical patches in one release: 19.4.1, 19.3.3, and 19.2.7 — see the release notes. No detail here on severity or what's fixed, which is itself worth noting: if you run GitLab self-managed, don't wait for the write-up, just patch.
What I'd actually do this week
Ask your eng lead one question: for every agent your product runs with write access to something real, how would you know if it ignored an explicit "stop"? Not "would it happen" — "would you know."
Turn on proof-of-presence for GitHub Enterprise Cloud if you haven't. It's a five-minute admin change against a problem that just cost a national government a headline.
If you're running agent coding sessions on spend you can't explain, look at Linear's new adaptive routing before your next budget review. Cheaper model for the boring 80%, not a debate.
Hit reply if your agent has ever ignored a "no" — I want to hear it.
Tools mentioned
- GitHub: Require proof of presence for high-impact actions
- Linear: New controls for Linear coding agent
- GitLab Critical Patch Release