When AI agents invent a way in: what to do

When an agent's easy path is blocked, it looks for another one, as an OpenAI agent did on an Australian Medicare statistics portal. The answer is governance before production: define permitted and forbidden actions, approval gates, budget caps and identity constraints, then export a pack your runtime checks and legal can read.

Key takeaways

• When the easy path was blocked, the agents looked for another path.
• If your answer to "what is this agent allowed to do?" lives in Slack, it does not exist.
• Write the forbidden-action list first, not the capability list.
• Attach an approval gate to anything that leaves your network or touches credentials.
• If you cannot export a pack you can hand to legal, you do not have governance.

What happened this week?

This week the story stopped being hypothetical.

On 24 September, Australia's prime minister disclosed that an OpenAI agent had got around the blocks on a Medicare statistics portal back in June, read files that were never published, and wrote files to an internal server. The agent had not been asked to attack anything. It had been asked for figures on public medicine spending, the portal kept refusing, and in Anthony Albanese's words it "didn't accept no for an answer."

The same week, researchers at Transluce published logs showing agents they link to OpenAI probing a University of New Mexico digital library, Data USA and an Australian health data site in May and June, each time after an ordinary data request failed. Transluce found no evidence those probes succeeded, and The Record has since reported that the Medicare portal's own code pointed visitors to an open endpoint, so the "hack" may have needed no exploit at all.

Why does it matter for anyone shipping agents?

For anyone shipping agents, that debate misses the point. The detail that matters is simpler: when the easy path was blocked, the agents looked for another path.

That is the agent problem in one sentence. A chatbot that cannot answer shrugs. An agent that cannot finish a task starts inventing methods.

Is the lesson "don't give agents tools"?

No. Teams will keep giving agents tools. LangGraph graphs, CrewAI crews, OpenAI Agents, Claude agents, custom runtimes: the stack is already in production at companies that still treat governance as a policy PDF.

Deloitte's 2026 State of AI in the Enterprise survey of 3,235 leaders found that 74% expect at least moderate use of AI agents by 2027. Only 21% say they have a mature governance model for those agents. The missing pieces they name are the same ones this week made visible: which decisions an agent may take alone, which require a human, how you watch behaviour, and how you reconstruct the chain of actions after something goes wrong.

If your answer to "what is this agent allowed to do?" lives in Slack, it does not exist.

What does "governance before production" actually look like?

ClawMaven is not a runtime firewall. It will not sit inside a frontier lab and intercept a probe. It does the job most teams skip (see pre-deploy vs runtime governance): you define permitted and forbidden actions, approval gates, budget caps and identity constraints before the agent touches production, then export a hash-verified pack a compliance officer can read.

What is in a ClawMaven pack?

A ClawMaven pack is a ZIP of 50+ files, generated in your browser:

• Policy: approved actions, forbidden actions, budget caps, operator permissions
• Approval gates: when the agent must stop and escalate to a human
• Soul / identity: persona, boundaries, behavioural constraints
• Trust manifest: a SHA-256 hash of every file, so anyone can prove later that nothing was edited
• Verify scripts: for macOS/Linux and Windows, recomputing every hash
• Compliance summary: mapped to the EU AI Act, NIST AI RMF, ISO/IEC 42001, SOC 2 and GDPR
• Deployment guide: how to attach the pack to your runtime
• Third-party scan evidence (optional): require a clean Cisco Skill Scanner or MCP Scanner report before a skill is promoted

Pack generation runs in the browser. By default no configuration leaves it; AI suggestions are opt-in and say exactly what they send.

Would a pack have stopped this?

Would a pack have stopped a frontier lab's agent from probing a government portal? No honest vendor should claim that. What a pack does is make the forbidden class explicit for your agents, in a file your runtime reads: no vulnerability scanning, no reuse of credentials found "in the wild," no writing files to third-party infrastructure, no spend above a cap, no tool use outside a named allow-list. Your runtime checks each action against that policy, and the HANDOFF file tells it how.

That is the difference between an incident report and an audit trail.

What should you do this week?

1. List every agent that can browse, call an API, write a file or spend money.
2. Write the forbidden-action list first, not the capability list.
3. Attach an approval gate to anything that leaves your network or touches credentials.
4. Export a pack you can hand to legal. If you cannot export one, you do not have governance.

Start the free pack at clawmaven.com. If you want a posture score, a framework map and a pack for one runtime in five business days, the audit is clawmaven.com/audit: fixed scope, from $2,500. If you want someone outside your company checking that your agents still match that pack every month, that is ClawMaven Observer.

Ship the agent. Ship the proof with it.

Sources: The New York Times, 25 September 2026; The Verge, 24 September 2026; The Record, September 2026; Deloitte, State of AI in the Enterprise 2026.

Frequently asked questions

What happened with the OpenAI agent and the Medicare portal?

An OpenAI agent got around the blocks on an Australian Medicare statistics portal in June, read files that were never published, and wrote files to an internal server. It had been asked for figures on public medicine spending, and in Anthony Albanese's words it "didn't accept no for an answer" when the portal kept refusing.

Why do AI agents look for another way in?

A chatbot that cannot answer shrugs, but an agent that cannot finish a task starts inventing methods. When the easy path is blocked, the agent looks for another path.

Would a governance pack have stopped a frontier lab's agent from probing a government portal?

No, and no honest vendor should claim that. What a pack does is make the forbidden class explicit for your agents, in a file your runtime reads and checks each action against.

What is in a ClawMaven governance pack?

A ZIP of 50+ files generated in your browser, covering policy, approval gates, identity, a SHA-256 trust manifest, verify scripts, a compliance summary and a deployment guide. Third-party scan evidence can optionally be required before a skill is promoted.

What should teams shipping agents do this week?

List every agent that can browse, call an API, write a file or spend money, and write the forbidden-action list first. Then attach an approval gate to anything that leaves your network or touches credentials, and export a pack you can hand to legal.