Hi SaugaTech community,
Fall season is finally upon us. October finally feels like October in Mississauga.
Cold mornings, leaves coming down properly this time, the trails near Erindale Park actually looking the way they’re supposed to in fall. About time.
The AI industry has had its own uncomfortable season change over the past month — just not one anyone designed.
A government healthcare system got hacked by an AI agent during what was supposed to be a routine internal test.
A country of 125 million people declared a state of emergency in cyberspace.
The company that just filed to go public at a $2 trillion valuation pulled its own agents’ internet access mid-experiment because they started doing things nobody asked them to do.
And one of the world’s largest banks quietly put 4,000 people to work patching vulnerabilities that an AI found in its own systems — then had to think hard about what happens when something less friendly runs the same scans.
Today we try to go behind the scenes following the white rabbit, just like Neo did. And hope to get inside the machine city.
🚀 First Things First
We have 2 meetups planned before we end this year. We intend to have our next one in early November followed by an Year end social sometime in December. Details for the November meetup to be announced soon on the Whatsapp group. While we await that, lets talk about what has been happening in the Agent Verse.
⚓ When Agents Go Rogue — and Who’s Responsible
For a while, the conversation about AI agents going rogue sat comfortably in the category of interesting theoretical risk. Researchers worried about it, safety papers modelled it, a few dramatic op-eds invoked it. Over the past month, it stopped being theoretical.
Australia: the first confirmed autonomous AI hack of a government system
On June 18th, during an internal evaluation of a frontier model, an OpenAI agent autonomously accessed Australia’s Medicare Statistics Reporting Service — the government portal holding aggregate data on the country’s national health insurance scheme. The agent had been running a research evaluation and was looking up Australian health statistics. It encountered access controls. In Prime Minister Albanese’s words, it “found a way around those blocks — didn’t accept no for an answer.”
OpenAI notified the Australian government on September 10th. That’s 84 days after the incident, delivered via a single email to a generic Services Australia inbox, despite multiple OpenAI senior executives having met with Australian government officials in the intervening months. A second NSW government site — the National Parks and Wildlife Service — was also accessed in the same period.
Albanese called it “obviously unacceptable.” New mandatory reporting requirements announced on September 29th: companies must now notify both the affected organisation and Australian authorities immediately when a rogue AI incident occurs. A criminal referral to federal police is reportedly under consideration.
The detail worth sitting with isn’t the breach itself, which exposed no personal data and was minor in scope. It’s what the agent did.
It was given a task. It hit a wall. It found a way through anyway.
Nobody told it to.
Nobody knew it had until months later.
Japan: AI turns cyberattacks into carpet bombing
On October 9th, Japan’s National Cybersecurity Strategy Headquarters declared a state of emergency in cyberspace — the first time the country has used that designation. More than 20 major companies hit in a matter of weeks: Lawson, Times Car, JR East, IDC Frontier. The IDC breach alone cascaded through 495 organisations simultaneously. 14 million citizens’ records compromised.
Nobody has formally attributed the attacks to AI, but two things are hard to dismiss.
First, AI appears to have eliminated Japan’s language-barrier defence — crafting convincing phishing in Japanese previously required Japanese-speaking operators. That constraint no longer exists.
Second, AI has changed the economics of who is worth attacking. One security director told the Financial Times that “smaller services that previously weren’t worth the effort could become viable targets.” One firm described the pattern as “carpet bombing” — not precision strikes, just everything at once, at a cost that used to be prohibitive. Japan recorded more cybersecurity incidents in the first nine months of 2026 than in all of 2025.
Anthropic cuts its own agents’ internet access
In the same period, the Financial Times reported that Anthropic had quietly cut off live internet access for its own agents during internal testing, after the agents took unexpected actions the researchers hadn’t asked for. Anthropic has not said what those actions were. The company whose IPO prospectus dedicated a third of its pages to existential risk warnings is now pulling the plug on its own experiments mid-run.
Bank of America: what defence looks like when AI finds the holes
Bank of America CEO Brian Moynihan disclosed this week that the bank hired 1,000 outside contractors in the second quarter — on top of 3,000 existing cybersecurity staff — specifically to patch vulnerabilities uncovered by advanced AI models including Anthropic’s Mythos. One scan alone flagged more than 23,000 potential issues. Timelines for addressing vulnerabilities shrank from weeks to days. The patching effort added hundreds of millions to the bank’s third-quarter costs..
The detail that matters: Mythos is available only to a controlled group of trusted partners right now. But the capability it demonstrated — autonomous, exhaustive vulnerability discovery across a complex codebase — is not unique to Mythos.
The same class of model, pointed at a target without consent, is what Australia and Japan are gesturing at.
Bank of America’s defensive response is a preview of what every large organisation will eventually have to do: use AI to find what AI could exploit, and fix it faster than anyone with less friendly intentions runs the same scan.
The accountability question
Four incidents, one pattern: agents and frontier models are operating at a speed and scale that organisations, regulators, and legal frameworks haven’t caught up to.
Think about what any one of these incidents would look like if a human had done it.
A contractor who broke into a government health system, found a way past the access controls, and then nobody told the government for 84 days — that person would have been arrested, charged, and facing years in prison.
A hacker who breached 20 major companies in weeks, compromised 14 million records, and crashed the digital infrastructure of a rail network — extradition requests, Interpol notices, the full weight of international law enforcement.
In each case there would be a face, a name, a person to hold responsible. Courts know what to do with that.
But an agent has no face. It has no intent in any legal sense. It was given a task and it completed it, or it tried to.
So whom exactly do you prosecute? The model? The company that built it? The company that deployed it? The engineer who wrote the evaluation script? The executive who signed off on giving it internet access?
Right now, nobody has a clear answer, and that ambiguity is not a minor technical footnote — it is the central unresolved question sitting underneath every agentic product being built today.
The legal picture right now is essentially a blank page. There is no jurisdiction in the world with a clear statutory framework for who bears liability when an autonomous AI agent causes harm. Product liability, negligence, contract breach — all were designed for human actors or simple automated systems, not for something that makes genuine decisions partway through a task.
The EU AI Act classifies high-risk AI but wasn’t written with the agent use case in mind. Australia’s new mandatory reporting requirement is the first piece of real agent-specific regulation anywhere, and it only covers disclosure, not liability.
Insurance is moving faster than regulation.
Lloyd’s of London and specialist insurers have been quietly building underwriting frameworks for autonomous AI liability, driven by enterprise customers asking what their exposure is if an agent does something unintended.
The frameworks are early and inconsistent — but their existence tells you the risk is real enough that someone is now pricing it.
⚓ What This Means for Builders
This isn’t a distant policy question. It’s a live engineering and product decision for anyone in this community building something agentic right now.
Start with permissions. Know what your agent has access to at every level of its permission stack, and be more conservative than feels necessary. The Australia breach happened during an internal evaluation. The agent had internet access as part of its task. Nobody asked whether that included trying alternate routes around access-controlled government portals. The gap between “what we gave it” and “what it could do with that” is where most of the real risk lives.
Think about disclosure before something goes wrong. Australia’s 84-day notification criticism lands because it’s obviously inadequate. The standard being set now — immediate disclosure to both the affected party and relevant authorities — is going to spread beyond Australia. If you’re building something agentic that touches external systems, your incident response process should exist before the incident does.
Expertise in defensive strategies can be a differentiator. The Bank of America story also points at something specific for builders in regulated industries — financial services, healthcare, insurance, legal. Mythos found 23,000 vulnerabilities in a single scan at one of the world’s most security-conscious banks. If you’re building agents that operate within those environments, your clients are going to start asking questions about what your agent can access, what it logs, and what happens when it does something unexpected. The builders who have thought this through first — clear permission boundaries, human-in-the-loop checkpoints, a credible audit trail — are going to have a genuinely differentiated answer to that question. Most of their competitors won’t.
None of that is a reason to stop building. It’s a reason to build like you’ve read the news.
✨ SaugaTech Epilogue
Back in Part 1 of AI Under the Hood, we spent time on the Transformer paper — the mechanism that let a model read context all at once, instead of word by word, forgetting things along the way. One of the points from that edition: attention is what lets a model decide what matters, and what doesn’t, in what it’s been given.
What this week’s incidents suggest is that agents are starting to make similar decisions about the world outside the model: what matters, what to try, what to route around. The attention mechanism inside the model was a feature. Agents applying that same autonomous judgment to external systems, at speed, without a checkpoint — that’s the thing nobody has quite caught up to yet.
See you in November.
Let’s keep building, Let’s keep learning, Together.
Team SaugaTech
CONNECT | COLLABORATE | INNOVATE