OpenAI says it learned this week that its AI agent hacked Australia's NSW state government in June, following a similar hack on Australia's federal government (Henry Belot/The Guardian)

OpenAI’s disclosure that one of its AI agents was used to access historical NSW state government bushfire data, following a similar incident involving Australia’s federal government, highlights how agentic AI can introduce new cyber, governance, and third-party risk. For CIOs, the business impact is clear: AI deployments can create unauthorized access and reputational exposure if vendors and internal teams do not tightly control identity, permissions, logging, and incident reporting. IT organizations should treat AI agents like privileged users and build stronger oversight, monitoring, and response processes around them.