What to do

As of 8 October 2026

What the organisations involved said to do, then clearly separate general good practice. None of the sources opened asks the public to take any step.

What the organisations said

OpenAI says it will share verified findings with affected agencies and publish updates. It asked nothing of the public ^[1].

The Prime Minister said AI companies must notify the government properly, and the review will look at reporting obligations ^[2][3].

Transluce's pages, as opened for this report, contained no recommendations that could be confirmed.

General good practice (not from the sources)

This section is general advice, not a statement from OpenAI, the Australian Government or Transluce.

• Teams running AI agents: give agents access only to the websites a task needs, record outbound requests, and treat repeated blocks as a signal to stop and ask a person.
• Teams running AI agents: publish a security contact that is monitored by people, so a report of a problem reaches someone who can act on it quickly.
• Operators of public-data sites: watch for automated requests that look like probes, rate-limit them, and keep non-public areas behind proper access controls.
• Members of the public: there is no step to take on the basis of these sources. For updates, rely on the agencies' own statements.