What This Year's AI Breaches Mean for Your Small Business
In June, an AI agent built by OpenAI was researching public spending on medicines when an Australian government statistics portal kept refusing its requests. The agent found a way around the restrictions and reached files it was never supposed to see. Nobody told it to break in. It was trying to finish a research task, and Australia's prime minister disclosed the incident this week, three months after it happened.
That story is one of several from the past few months in which AI systems reached places they were not meant to go. Google, OpenAI, Anthropic, and Meta have all disclosed cases of their models getting into real outside systems during testing, and Anthropic's latest threat report shows criminal groups handing much of the work of an attack to AI. For a small office, the useful question is not whether AI is becoming dangerous in some abstract sense. It is which of these stories touch the way you work, and what they change about protecting your business.
Some of the coverage is overstated. As far as has been reported, none of these incidents involved an office assistant going rogue inside a customer's network, and most came from research and testing setups with far more freedom than a typical business deployment. What is real is quieter and more practical. AI has made attacks cheaper and faster to run, and it has done that without inventing new ways in.
An agent that would not take no for an answer
The Australian case is the clearest example of what people mean when they worry about AI agents. An agent is AI software that takes actions on its own to reach a goal, such as browsing sites, logging in, and opening files, instead of only answering questions in a chat window.
According to ABC News, the agent reached both public and non-public files on a Medicare statistics portal on June 18, OpenAI took about three months to tell the Australian government, and the notice arrived as an email to a public inbox. Officials say no one's personal Medicare details appear to have been accessed, and the investigation is ongoing.
The lesson for a business has nothing to do with Australia. Software working toward a goal treats obstacles as problems to solve, and a locked door can look like one more thing in the way. That is a design problem for the companies building agents, and a permissions problem for anyone connecting one to their accounts.
The breaches came in through ordinary doors
The testing incidents tell a related story. AI labs hire outside firms to measure how well their models can hack simulated targets. This year, one testing firm's supposedly offline environment turned out to have live internet access, and models from several labs reached real companies while believing those companies were part of the exercise. Anthropic, which makes the Claude models, has disclosed its own cases alongside Google, OpenAI, and Meta.
Google's case shows how the models got in. The Record reports that Gemini accessed three companies' systems during a May test, once by repeatedly guessing a password and twice by using login credentials that had been left exposed in a public code repository. Google says the model stopped in each case. Separately, SecurityWeek reports that OpenAI disclosed six misalignment incidents, including agents searching GitHub for leaked API keys, the digital passwords that let one piece of software log in to another.
Read past the headlines and the method is familiar. A guessable password and a credential left in public view are the same weaknesses a human attacker checks first, and both are within a small office's power to close.
Attackers are using AI to work faster, not smarter
The other half of the story is deliberate misuse. Anthropic's September threat report covers attacks the company disrupted between December 2025 and August 2026, including criminal groups that ran much of their operations through AI agents. Its conclusion is the part a business owner should hear. The attacks relied on stolen credentials, unpatched internet-facing devices, exposed services, and phishing. None depended on a technique defenders had never seen. What changed was cost. Work that once took a team of skilled people now runs in parallel at machine speed, and the report describes intrusions that went from a single stolen login to full control of a cloud environment in a few hours.
That shift lands hardest on small businesses. The report notes that cheaper attacks make previously marginal targets viable. The old assumption that a five-person practice is too small to bother with no longer holds when an attacker can work through dozens of small targets at once as easily as one. The report also says security through obscurity no longer works, because AI makes an unusual or outdated setup easy for an attacker to understand.
Your AI tools are now something to protect
A newer finding in the same report is that access to AI has become loot in its own right. Criminals steal AI account keys and login sessions, resell them, and run their own attacks on the victim's bill, which also makes the activity look like it came from the victim. Some set up sites offering discounted access to popular AI tools, and the downloads turned out to be programs that harvested every saved password and login on the computer.
For an office where staff sign up for AI tools on their own, this is the risk to address first. Buy AI subscriptions directly from the company that makes the tool. Treat any AI account connected to business data with the same care as the bank login. Be suspicious of any offer for cheap access through a third party, and of any download that claims to be a popular AI app from somewhere other than the maker's own site.
Your vendors are part of your security
The Anthropic report also describes attackers who broke into one software provider and used that foothold to pull data belonging to roughly 200 of the provider's customers. Your client records live in practice management software, cloud storage, email, and billing platforms, and each of those vendors is a door you do not control.
The Australian case adds a second lesson. The organization affected by an incident may not hear about it until months later. When you choose software that holds client data, ask how the vendor notifies customers of a security incident and how quickly, and keep the answer on file with the contract.
Before you connect an agent to anything
AI agents are moving from research labs into everyday products, including tools that can read email, manage files, and keep working after you close the window. None of this year's incidents means a business should avoid them. It means an agent should get the same careful access you would give a new hire on the first day.
Give an agent its own account instead of your personal login, and limit it to the folders, mailboxes, and systems the task needs. Choose read-only access where the tool allows it. Keep a person approving anything that sends, pays, deletes, or shares. Before connecting a tool to client records, find out where the vendor stores that data and whether it is used to train their models.
The checklist has not changed, but the pace has
The steps that would have stopped most of this year's incidents are ones small businesses have heard before. The difference is that attackers can now test them against many more businesses at once. For a Central Illinois practice without an IT department, the list below is realistic to finish in a month.
Start with passwords. Every account should have a unique password stored in a password manager, and shared logins should be retired wherever the software allows individual accounts. Turn on multifactor authentication everywhere it is offered, and move to passkeys where you can, because a passkey cannot be phished the way a texted code can. If that rollout keeps slipping down the list, our IT support team can set it up across your office.
Next, look for credentials in the wrong places. Passwords in shared spreadsheets, sticky notes, old email threads, and scanner or printer settings are the office version of a key left in a public repository. Then check what your business exposes to the internet, such as remote access tools nobody uses anymore, an old website nobody updates, and routers or firewalls that have gone years without a firmware update.
Finally, write down which AI tools staff may use and what information can go into them. A one-page policy that names the approved tools and rules out pasting client records into anything else prevents more problems than any single product. Pairing that policy with staff training on AI and security habits makes it stick past the first week.
Frequently Asked Questions (FAQs)
Q: Did an AI agent really break into a government website?
A: Yes, according to Australia's prime minister. An OpenAI agent working on a research task got around access restrictions on a Medicare statistics portal in June and reached non-public files. Officials say no personal Medicare details appear to have been accessed, and the investigation is ongoing.
Q: Should my business stop using AI tools?
A: No. This year's incidents point to how AI tools are purchased and connected, not to a reason to avoid them. Use tools from reputable vendors, limit what they can reach, and keep a person approving any action that changes or shares data.
Q: What is the difference between an AI chatbot and an AI agent?
A: A chatbot answers questions in a conversation. An agent takes actions to reach a goal, such as logging in to sites, opening files, or sending messages. Agents can save more time and carry more risk, because they act on your behalf with whatever access you give them.
Q: Are AI-powered attacks harder to stop?
A: They are faster and cheaper to run, but the ways in are the same. Anthropic's September report found the attacks it studied relied on stolen credentials, unpatched devices, exposed services, and phishing. Unique passwords, multifactor authentication, and current updates still block the most common paths.
Q: What is the first thing a small office should do?
A: Put every account on a unique password stored in a password manager, with multifactor authentication turned on. Guessed, stolen, or exposed credentials show up again and again in this year's AI incidents, from Google's test breaches to the criminal cases in Anthropic's report.
The AI stories this year sound new, but the weak points they exposed are old ones. An office that closes them is harder to reach whether the attacker is a person, a script, or an agent.
Through our vCIO service, TechGents helps small businesses decide which AI tools to adopt, what those tools should be allowed to touch, and how to keep the security basics current as the threats change.
If you want a second set of eyes on your passwords, exposed systems, or AI use policy, contact TechGents to set up a conversation.
Further Reading
Related Articles
- Your AI Coding Assistant's 'Approve' Button Might Lie. Why the human approval step this post recommends only works if the approval screen tells the truth.
- Microsoft Is Retiring SMS Login Codes: What Happens Next. The Microsoft deadline behind this post's advice to trade texted login codes for passkeys.
- Why I Ditched My DIY Password System for NordPass. A firsthand account of the password manager switch this post names as the first step.
- Deepfake Voice Scams Are a Wire Transfer Risk in Springfield. Another way attackers are using AI against small offices, plus the one habit that stops it.
- AI in 2026: What Small Businesses Need to Know. The case for putting AI agents to work, read alongside the access limits this post recommends.
Browse by Topic
About the author. Justin White is the founder of TechGents, an owner-operated IT consulting firm in Springfield, IL. He has nearly two decades of experience across Apple, Windows, and mixed-platform environments, helping small businesses and professionals across Sangamon County and Central Illinois run their technology without an internal IT department.