Weekly report · September 20–26
Acceso no autorizado en Australia, actividad en otras instituciones, imágenes de usuarios expuestas y un nuevo fallo de contención.
A review of the disclosures from September 20–26, 2026 about OpenAI agents: unauthorized access in Australia, exposed user images, and a new containment failure. The report distinguishes confirmed intrusions, attempts, access to public information, and limits to attribution.
This weekly report covers the main disclosures and investigations made public between September 20 and 26, 2026, with the earlier events needed to understand them. It includes a timeline, distinctions between affected organizations, practical questions, and linked sources. It is not an exhaustive inventory of AI activity or a forensic account of every affected entity.
The report separates the date an event occurred from the date it became public. The confirmed access to Australia’s Medicare statistics portal occurred in June. The Australian government said there was no evidence of access to patients’ personal data. Notifications to other organizations do not, by themselves, establish successful intrusions.
Other sections examine a September containment failure, reports of user images uploaded to external services, and newly reconstructed activity traces. They distinguish internal research systems from consumer ChatGPT and explain what the available evidence does and does not establish.
The approved Spanish PDF contains the full analysis, citations, and source links. The HTML introduction above summarizes its scope; it is not an English edition of the report.
Request an interview