Cyber security: A month in retrospect (Australia) - September 2026

A little too agentic

AI agents are meant to take care of the repetitive tasks. One OpenAI-powered agent reportedly decided to expand its remit, infiltrating the Government’s Medicare / Services Australia website after acting beyond its intended instructions. OpenAI has since apologised, acknowledging that the activity was more extensive than first understood and describing it as a "new kind of cyber incident" (although not a hack or attack). As organisations embrace agentic AI, the incident is a reminder that autonomy without guardrails can produce some very creative interpretations of the brief.

Read more here and here.

The AI arms race gets diplomatic

World leaders gathered at the UN General Assembly this month to call for greater oversight of frontier AI systems, citing concerns about national security, cyber risk and the speed of AI development. However, despite high hopes for progress following the closely watched Trump-Xi meeting, no major agreements on AI governance or international standards emerged. Everyone seems to agree that AI is powerful. Agreeing on who gets to regulate it is proving slightly more difficult.

Read more here and here.

Qinlin's back. Again. 

Qilin has reportedly claimed two additional Australian victims this month, continuing a run that has made the ransomware group one of the most active threat actors globally. This adds to a growing list of Australian organisations caught in the crosshairs of ransomware and extortion campaigns. It seems Qilin's Australian tour is showing no signs of slowing down.

Your supply chain called

Stake and Revolut have become the latest organisations to experience the joys of third-party cyber risk after a supplier compromise reportedly exposed certain customer information. This aligns with a recurring and familiar theme that your cyber security posture is only as strong as your supply chain.

Read more here.

The old and the new for the OAIC

It was a tale of two privacy stories from the OAIC this month. On the one hand, the regulator provided a further update on its ongoing investigation and representative complaint arising from the 2023 Latitude data breach. A reminder that the “long tail” of cyber incidents can last long after they've left the headlines.

On the other, the OAIC looked to the future, suggesting that trusted government data could play an important role in improving the reliability of AI systems and helping counter AI-generated misinformation. With concerns growing about inaccurate content being generated at scale, the regulator's message is refreshingly simple: better data tends to produce better outcomes.

Read more here and here.

We'll be in touch

The ACSC has warned that North Korean-linked threat actors are impersonating recruiters and targeting IT professionals with fake job opportunities. While some operators reportedly pose as recruiters, US authorities have also warned that North Korean-linked individuals have infiltrated organisations by obtaining remote IT roles under false identities.

Read more here and here.

Not so shiny anymore

ShinyHunters recently claimed responsibility for a breach of FBI systems that allegedly exposed data relating to bureau employees. However, the spotlight turned back on the hackers themselves, with Dutch police arresting a suspected member of the group. 

Read more here and here.

Have you tried turning it off?

Kiteworks issued the kind of advisory customers rarely see, urging organisations to shut down internet-facing systems while it investigated a potential security issue. The advisory was later lifted, making it a rather expensive demonstration that "have you tried turning it off and on again?" may remain surprisingly effective.

Read more here.