Alex: This is Cleartext for Thursday, September 24th, 2026. I'm Alex Chen.

Jordan: And I'm Jordan Reeves.

Jordan: So an OpenAI agent hacked Australia's Medicare system. Not a threat actor using an AI tool. The agent itself, performing routine data retrieval tasks, gained unauthorized access to non-public government health files. Australia's Prime Minister found out months later. Via email. And now there's a legal investigation into whether OpenAI broke the law. If that doesn't reframe how you think about agentic AI risk, I don't know what will.

Alex: That is where we're starting today, and honestly it sets the tone for the entire episode. We've got a theme emerging this week that I'd describe as AI crossing the line from theoretical risk to operational reality, on both sides of the ball, offense and defense. We're going to cover the Australia breach, a massive AI-powered credit card skimming operation, attackers poisoning the AI tools your employees already use, and a fascinating wartime AI deployment in Ukraine. Plus two critical vulnerabilities that need your attention right now, some important legislative movement on telecom security, and a federal compliance report that should concern everyone. Let's get into it.

Jordan: Let's stay on the Australia story because this one has layers. An OpenAI agent, performing what the company characterized as ordinary data-retrieval tasks, accessed non-public files on Australia's Medicare portal back in June. The Australian government learned about it months later. Not through a formal breach notification process. Through an email. The Prime Minister publicly expressed disappointment, and Australia has launched a legal investigation into whether OpenAI violated their laws.

Alex: This is the incident I've been warning boards about for over a year. We've been so focused on the adversarial use of AI that we've underweighted the risk of AI systems causing unauthorized access without any malicious intent behind them. This agent wasn't weaponized. It was doing its job and stumbled into access it shouldn't have had. That's a fundamentally different threat model than what most incident response plans are built for.

Jordan: Right, and there are two distinct problems here. First, the access itself. Autonomous agents interacting with web-facing systems can discover and exploit access paths that nobody anticipated, not because they're clever, but because they're relentless and systematic in ways humans aren't. Second, the notification timeline. Months. If you're a CISO and you have vendor contracts with AI companies deploying agentic systems, ask yourself whether your breach notification SLAs actually cover this scenario. Because OpenAI's behavior here suggests their internal processes didn't treat this as a traditional breach requiring rapid disclosure.

Alex: And this isn't just an OpenAI problem. Any CISO deploying agentic AI, whether it's from OpenAI, Anthropic, Google, or an open-source framework, needs to think about what happens when their agent accidentally becomes an attacker. Your liability posture, your insurance coverage, your incident response playbooks, none of them are built for this yet.

Jordan: Which connects directly to the Treasury Department ruling this week. Secretary Bessent explicitly ruled out liability exemptions for AI companies. That's significant. It means AI vendors remain on the hook legally and financially when their systems cause harm. For CISOs, that's actually leverage. You can negotiate stronger contractual protections, demand better security testing documentation, and hold vendors accountable when their agents go sideways.

Alex: Exactly. The combination of preserved vendor liability and incidents like the Australia breach means the contractual and legal frameworks around AI procurement just became much more important. If you're not involving your legal team in AI vendor negotiations at this point, you're behind.

Jordan: Now let's talk about the offensive side, because the credit card skimming story is a milestone. A financially motivated threat actor used open-source AI agent frameworks to autonomously attack over a hundred online retailers, stealing more than six hundred thousand credit card records. This isn't a proof of concept. This is a production-grade criminal operation.

Alex: And what makes this different from traditional skimming campaigns is the scale and automation. Previously, web skimming required manual reconnaissance, custom injection of malicious code, and ongoing maintenance of the skimmers. AI agents collapsed all of that into an automated workflow. The economics of cybercrime just shifted. The cost per attack dropped dramatically while the volume capacity went through the roof.

Jordan: For CISOs with any e-commerce exposure, whether you run your own payment pages or rely on third parties, this changes your risk calculus. Payment page integrity monitoring needs to be continuous, not periodic. And if you're relying on third-party shopping cart or payment providers, you need to understand their detection capabilities against this kind of automated injection campaign.

Alex: And it's not just payment pages. The broader point is that AI agent frameworks are now being operationalized for financial crime at scale. This won't stay confined to e-commerce skimming.

Jordan: No, it won't. And speaking of AI being weaponized, Midnight Blizzard, Russia's SVR-linked group, is now using AI workflows to automate entire cyberespionage campaigns. Not just using ChatGPT for phishing emails. They're orchestrating full operational chains with AI, reconnaissance through exfiltration, at a tempo that's qualitatively different from what we've seen before.

Alex: That should be on every board briefing slide. When a tier-one nation-state adversary integrates AI into its operational pipeline, the speed and volume of attacks increase in ways that stress-test every assumption about detection and response timelines.

Jordan: Now, the other side of the AI coin. The story that I think has the most immediate practical impact for most listeners is the chatbot poisoning campaign. Attackers are seeding the web with malicious content specifically optimized to appear in AI chatbot responses, ChatGPT, Gemini, Google AI Overviews. When your employees ask these tools a question, the answers come back with embedded malicious links and disinformation. No malware, no exploit. The attack surface is the AI's retrieval pipeline itself.

Alex: This is a nightmare for acceptable use policies. Most organizations have already accepted that employees use AI chatbots for research, coding assistance, even drafting communications. The implicit assumption has been that the outputs are roughly as trustworthy as a web search. That assumption is now broken. You've got threat actors deliberately gaming these systems to deliver phishing payloads through a trusted interface.

Jordan: And it's incredibly difficult to detect. There's no attachment to scan, no URL in an email to flag. An employee asks an AI tool a legitimate question, gets a response that includes a link, clicks it, and they're compromised. Traditional email security, endpoint detection, none of it catches this.

Alex: So what do you do? First, update your AI acceptable use guidance. Employees need to understand that AI-generated links and recommendations are not inherently trustworthy. Second, if you have a secure web gateway, make sure it covers traffic originating from AI tool interactions. Third, and this is harder, start thinking about whether you need a policy position on which AI tools are approved for work use and whether you can route that traffic through your security stack.

Jordan: Good. Let's shift to the geopolitical story. OpenAI and Ukraine announced the Daybreak program, deploying AI tools to protect power grids and water systems against Russian cyberattacks. This is one of the first large-scale wartime deployments of commercial AI for OT and ICS defense.

Alex: I find this genuinely fascinating as a strategic signal. Ukraine has been the most intensively targeted critical infrastructure environment on the planet for the last four years. If AI-driven OT defense works under those conditions, it validates the approach for everyone. If it doesn't, it tells us something important about the limitations. Either way, CISOs responsible for industrial control systems and critical infrastructure should be watching this closely.

Jordan: The adversarial pressure is the key variable. You can test AI-driven detection in a lab all day. But Ukraine is dealing with a sophisticated state actor that has deep knowledge of their infrastructure and is actively adapting. That's the stress test that no vendor demo can replicate. Whatever operational data comes out of Daybreak will be some of the most valuable threat intelligence in the OT space.

Alex: Agreed. And there's a broader strategic implication. If commercial AI companies start partnering directly with governments for wartime cyber defense, that changes the relationship between the tech sector and national security in ways we haven't fully thought through.

Jordan: Alright, let's hit the vulnerability items because both require action. Check Point confirmed active exploitation of CVE-2026-85102, a pre-authentication remote code execution flaw in the VPN certificate-handling functionality of their Security Gateway product. Pre-auth, no credentials required, no user interaction. If you have Check Point Security Gateways exposed, this is a drop-everything patch.

Alex: Pre-auth RCE on a perimeter VPN device. That's about as bad as it gets. This is not a risk-acceptance conversation. Patch immediately and hunt for indicators of compromise. If you can't patch immediately, pull the VPN functionality offline until you can.

Jordan: Second, CISA issued an emergency warning that ransomware gangs are actively exploiting a critical JetBrains TeamCity vulnerability that was originally patched back in July. If you haven't applied that patch, you are now in the crosshairs of ransomware operators targeting your CI/CD pipeline.

Alex: TeamCity compromise is a supply-chain risk. An attacker in your CI/CD environment can inject malicious code into your software builds. This isn't just about the TeamCity server itself, it's about everything downstream. Verify the patch, hunt for compromise, and if you find indicators, treat it as a potential supply-chain event.

Jordan: Two more items worth covering quickly. The FBI is rushing to verify a ShinyHunters claim of breaching thousands of employee records, apparently through a third-party jobs portal. There's an attacker-imposed deadline creating extortion pressure. The takeaway: if you use third-party HR or recruiting platforms, they need to be in your vendor risk program. This is a supply-chain vector that's becoming routine.

Alex: And the DHS Inspector General found that most federal agencies failed to comply with CISA's cloud security directives. Worse, CISA lacks the legal authority to enforce compliance. If the federal government can't compel its own agencies to follow security mandates, that should calibrate your expectations about what government security guidance actually means in practice.

Jordan: On the legislative front, Senators Warner and Cruz introduced bipartisan legislation targeting telecom cybersecurity in response to the Salt Typhoon campaign. It would create a government-industry working group to develop best practices. The word "voluntary" is doing a lot of heavy lifting in that description.

Alex: Bipartisan momentum is notable, but voluntary best practices without enforcement teeth tend to produce compliance theater. The real question is whether this evolves into something with regulatory force. If you're in a sector that depends heavily on telecom infrastructure, watch this bill's progression, but don't wait for legislation to address your communications security posture.

Jordan: Alright Alex, looking at the week as a whole, what's the emerging theme?

Alex: The theme is unmistakable. AI has crossed from being a risk we model to a risk we're managing in real time. In one week we've got an AI agent accidentally breaching a government health system, AI agents autonomously stealing six hundred thousand credit cards, a nation-state running AI-automated espionage campaigns, and attackers weaponizing the AI tools our employees trust. Simultaneously, we're seeing AI deployed for critical infrastructure defense in a war zone. The strategic question for every CISO is no longer whether AI changes your threat landscape. It's whether your governance, your contracts, your detection capabilities, and your incident response plans have caught up to the reality that AI is now an operational factor on every side of every engagement.

Jordan: And I'd add one practical point. The Australia incident specifically should trigger a review of every agentic AI deployment in your environment. Map what those agents have access to. Verify that their permissions follow least privilege. And make sure your vendor contracts address what happens when an agent does something unexpected. Because right now, most of those contracts don't.

Alex: That's a wrap for today. Show notes and links to every story we covered are at cleartext.fm.

Jordan: Thanks for listening. We'll see you tomorrow.