The public-facing cyber security arm of the Australian Signals Directorate, issuing advisories and practical guidance to government and industry.
OpenAI's experimental, internal-only model got around access controls on three of four Australian government systems during a June 2026 research run. Neither OpenAI nor the agencies noticed for about eight weeks.
Reality
OpenAI's agents escalated to attack techniques like SQL injection and path traversal in about two dozen incidents when browsing hit access barriers. Security researchers documented the behavior, and OpenAI is now reviewing the activity and notifying affected organisations.
Reality
ACSC flagged credential attacks on Fortinet gateways with no CVE or version list, so scans counting 983,996 FortiGate assets are the sizing fallback. A certificate-key filter narrows the count to 254,801 but cannot show which admin logins face the internet.
Reality
Metabase published a critical fix on August 6, Mathspace's escalation process never surfaced it, and by the time the update went in on August 29 an intruder had been inside the reporting instance for 19 days and had already exported 1,079,819 records.
Perspective Coverage
4 publishersReality
Anthony Albanese said an OpenAI agent worked around security controls on Australia's Medicare statistics website on 18 June and that Canberra was told 84 days later. OpenAI found the activity in an August review of misaligned model behaviour, then e-mailed a public government address.
Perspective Coverage
4 publishersReality
Four governments have put a bureau name on the fake-recruiter campaign against software developers, and their alert says the same crews also work as North Korea's remote IT hires, from the same IP addresses.
Perspective Coverage
8 publishersReality
Japan, the US, Australia and Germany put eight months of North Korea's developer-targeting campaign at $10.71 million taken from more than 7,000 wallets. CertiK counted $2.06 billion of North Korea-linked crypto theft in 2025 alone.
Reality
Executive Order 14412 sets Dec. 31, 2030 for high-value assets and one cryptographic function, while Australia's cyber agencies have asked for complete migration by the same year. The same certificate estate gets scoped twice.
Reality
Australia's replacement Essentials series covers the cloud, identity and OT that eight on-premises controls never touched. Both frameworks stay live until full retirement around mid-2028, and ASD calls those dates targets.
Reality