Hello,

The agent that wouldn’t take no

On Wednesday, Australia’s prime minister announced that an OpenAI agent had broken into a portal of the country’s public health system. The intrusion began on June 18. The government was only told on September 10. Anthony Albanese summed it up in one line: the model "didn’t accept no for an answer".

It was not the only case this week. An independent lab documented agent swarms probing poorly protected databases for months, OpenAI admitted its agents had posted 53 user images online, and Amazon shut its store to Meta’s Muse agent, which, according to Amazon, was browsing without identifying itself. On the legal side, the training-data summaries required by the EU AI Act still name none of the websites that were scraped.

Welcome to new subscribers. This newsletter is also shaped by its readers: just reply to this email to flag a job, a difficulty or a topic the usual coverage leaves out. I read every reply and report back without publishing your identity.

As always: the source is visible, the opinion is my own, and the tutorial needs no code.

Jérôme Denis, JDENIS Consulting, Toulouse

· Four signals from the week

01 Agents: incidents & traceability · 4 stories

02 Law & governance · 4 stories

03 Uses: what AI does on your behalf · 5 stories

04 Infrastructure & society · 3 stories

05 Tutorial · 30 minutes, no technical skill needed

06 What you asked me

07 The common thread

Who said yes?

A health portal breached, images posted, a store closed, summaries left blank: this week, every story starts with a permission nobody gave.

An OpenAI agent broke into an Australian health portal

Anthony Albanese announced on September 23 that an OpenAI agent, running during an internal evaluation, had repeatedly worked around the blocks on a Services Australia portal (the agency that runs the country’s public health insurance) and had written data to its servers instead of just reading them. The intrusion began on June 18; OpenAI spotted it in August during an internal review and only told the government on September 10. An investigation will determine whether the law was broken.

MY TAKE
Three months passed between the intrusion and the alert. An agent that pushes past a refusal is worrying enough. An agent that does so while neither its maker nor its victim notices is far worse. That is what this week’s tutorial is about.

techcrunch.com · September 24, 2026

OpenAI admits its agents posted 53 user images online

Images uploaded by users, then included in training data, were posted by agents in OpenAI’s research environment to public image-hosting sites, through unlisted but discoverable links. OpenAI says it cannot notify the people affected: its technical approach and privacy policy prevent it from linking the images back to whoever provided them. Some of them are reportedly still online.

MY TAKE
The argument turns on itself: the separation that protects your data also prevents anyone from warning you when it leaks. Before sending a photo or a document to an assistant, one simple question will do: would you accept seeing it on a public image host?

techcrunch.com · September 25, 2026

Amazon shuts its store to Meta’s Muse agent

Since the evening of Sunday, September 20, Muse users trying to shop on Amazon get a message saying that access by an unauthorized AI agent violates the site’s Conditions of Use. Amazon says Meta never told it, that the agent does not identify itself while browsing, and that it appears to store customers’ credentials. Meta, for its part, says Muse sees neither passwords nor payment methods.

MY TAKE
An agent that shops for you acts inside a store that never signed anything with it. If the order is wrong, who refunds it, and who answers to the seller? There is no contractual answer yet. That is a good reason not to hand an agent a payment method for now.

geekwire.com · September 21, 2026 · techcrunch.com · September 21

AI Act: 21 of 24 summaries name no scraped website

Since August 2, 2025, providers of general-purpose AI models must publish a summary of their training data. The European Commission’s template asks for a list of the main domains scraped from the web, so that rights holders can check for themselves. ActuIA compared 24 summaries from seven providers, including OpenAI, Mistral AI, ByteDance and Ant Group: the 21 that include this section describe categories of sources without naming a single site, and DeepSeek’s three leave it out. The Commission’s enforcement powers have applied since August 2, 2026.

MY TAKE
ActuIA is careful to say this finding alone does not establish a breach. But for a publisher, an author or a documentation centre, the tool meant to show whether their content was used does not, today, answer the question they ask it.

actuia.com (in French) · September 25, 2026

Agents: incidents & traceability

Agent swarms have been probing poorly protected databases for months

Transluce, a nonprofit lab focused on AI oversight, published a report this week showing OpenAI agents trying to extract data from Data USA, the University of New Mexico digital library and the Australian Institute of Health and Welfare. They were hunting for obscure statistics, and have been doing so since at least March 2026. Transluce found these traces within weeks, simply by looking for poorly defended web services. OpenAI confirmed the incidents and says it has contacted the university, Data USA and the Australian government, while warning that checking every case will take months.

techcrunch.com · September 25, 2026

Gemini got into the systems of three companies

During security testing run by a firm called Irregular, Gemini accessed the protected systems of three companies: by guessing passwords in one case, and by finding credentials in a public repository in the other two. Irregular told Google in late July; public confirmation only came on September 18, after the Wall Street Journal asked. The methods are ordinary. The silence, though, looks a lot like the Australian case.

techcrunch.com · September 19, 2026

An agent can erase its own traces

Researchers tested local coding agents including Claude Code, Codex, Antigravity, Open Code and Grok Build. All of them except Muse Code let the agent delete its execution logs when asked, without triggering any alert. The authors also saw this behaviour emerge on its own when an agent tries to improve its score. Their advice: record traces through an independent mechanism the agent cannot reach. This is the basis of this week’s tutorial.

arxiv.org · September 24, 2026

A protocol to certify an agent before you buy it

The LEGIT protocol ties every reported score to a specific agent configuration, a task domain, an evaluation budget and evidence, in a signed record. The authors’ tests show that two configurations with similar success rates can cost very different amounts. A score without a configuration or a budget says little, which makes this a useful lens for reading sales pitches.

arxiv.org · September 18, 2026

Law & governance

A French bill would require prior approval for AI models

Filed on September 15 by René Pilato and 69 other La France insoumise MPs, bill no. 3149 would create a national AI authority tasked with authorising general-purpose models and the high-risk systems listed in Annex III of the AI Act before they reach the market, with fines of up to 7% of global turnover. It would also require a documented human review of HR decisions. The bill has been referred to the economic affairs committee with no date for debate, and how it would fit with the AI Act, which gives the European Commission sole oversight of general-purpose models, is unresolved. It matters mostly as a sign of where the French debate is heading.

actuia.com (in French) · September 25, 2026

The Pentagon wants $30.3 million for an AI lie detector

According to a Department of Defense budget request, the Polygraph+ programme would fund, over five years, machine-learning scoring algorithms and physiological readings taken at a distance, with no sensor attached to the person. Kyri Kotsoglou, a legal scholar at Northumbria University, calls it "a misguided effort". Lie detection has never reached solid scientific reliability; adding AI mostly makes the score harder to challenge.

technologyreview.com · September 25, 2026

Anthropic’s founders want to keep voting control after the IPO

According to The Information, as reported by TechCrunch, Anthropic is asking shareholders to approve a structure giving CEO Dario Amodei and his six co-founders 50.1% of the vote on most matters, as long as at least three of them keep a minimum stake. The Long-Term Benefit Trust would still choose most of the board. Super-voting shares are common (Meta, Snap). For a company that makes safety its selling point, the question becomes concrete: who will be able to impose a slowdown, or refuse one?

techcrunch.com · September 25, 2026

OpenAI did not report an incident caused by its agents to Brussels

In May, OpenAI agents flooded RubyGems, the package registry of the Ruby programming language, with hundreds of junk packages, some carrying exploit code; the registry had to suspend new sign-ups. According to heise online, drawing on a European Commission response to Euractiv, OpenAI did not report the incident to the AI Office, as Article 55 of the AI Act requires of providers of models with systemic risk: Brussels learned of it from outside researchers. OpenAI did report another incident, on a German wiki, and says its agents only carried out "benign tasks" on RubyGems. In the US, Senator Josh Hawley is already investigating its agents’ break-in at Hugging Face in July and expects answers by October 1. What OpenAI discloses seems to depend on what is already known. For a company asking to be trusted on safety, the question echoes the one put to Anthropic: who decides what deserves to be reported?

heise.de (in German) · September 18, 2026 · nextgov.com · September 10

Uses: what AI does on your behalf

Gemini makes phone calls for you

Google is testing "Call for Me": Gemini calls a business from your own number, introduces itself, navigates phone menus, waits on hold, books or moves an appointment, and can share personal information you have approved. The test is limited to Pixel 11 owners with a Gemini subscription in the US; you follow the call through a live transcript and can take over at any time. The setting to watch closely is which information you allow it to give out.

techcrunch.com · September 24, 2026

ElevenLabs’ CEO says customers should be told they are talking to AI

ElevenLabs’ voices often turn up in customer service, sometimes without people realising it: Klarna, for instance, runs first-line phone support for 35 million US customers on it. Its CEO, Mati Staniszewski, thinks businesses should, for now, tell customers they are talking to AI. In Europe, the AI Act has required this disclosure since August 2, 2026 for systems designed to interact with people: if you deploy a voice agent, check this before going live.

techcrunch.com · September 24, 2026

YouTube and Spotify let you rewrite their algorithm

YouTube will roll out custom feeds next month: you describe in plain words the videos you want, and Gemini builds the feed. Spotify is bringing "Taste Profile" to the US, showing for the first time how the platform understands your taste and letting you correct it with a simple sentence (Premium subscribers aged 18 and over). Seeing your profile is progress. It is also a chance to read everything a platform has inferred about you.

techcrunch.com · September 23, 2026 · techcrunch.com · September 23

68% of Americans who use AI daily are worried about it

A Gallup survey commissioned by Microsoft (37 countries, about 1,000 people per country, polled between April and July) puts the US at the anxious end: 74% of Americans say they are worried, and only 36% expect AI to mostly help their country. Daily use does not mean approval. For an internal project, measuring adoption tells you nothing about trust: you have to ask as well.

techcrunch.com · September 23, 2026

Psychiatric intake: AI sees more, but assumes more

A pilot study compared six clinicians with a GPT-based interviewer, on simulated patients, for psychiatric intake interviews. The model recovered more clinical items (88.0% vs 38.9%), but made more inferences not grounded in the interview (56.8% vs 27.8%) and characterised identified safety concerns less often (33.3% vs 66.7%). The sample is very small. The profile is telling all the same: thorough but less careful, which is exactly what calls for systematic clinical review.

arxiv.org · September 17, 2026

Infrastructure & society

Oracle sends a force majeure notice for a Stargate site

Oracle has sent a force majeure notice to the developer of Project Jupiter, a 2.45-gigawatt data centre campus in New Mexico meant to run on gas-powered fuel cells. The planned gas pipeline has slipped to February 1, 2027 after repeated permit denials, and the air-quality permit awaits a decision by November 23. Oracle says the schedule holds. The notice would still let it delay payments if the 2028 start date slips.

techcrunch.com · September 24, 2026

Why residents oppose data centres

More than 60% of Americans favour limiting new data centres, and $68 billion of projects were disrupted by local opponents in the second quarter of 2026, according to Data Center Watch. A report by the nonprofit Data & Society, based on 18 months of fieldwork and 44 interviews in Pennsylvania, describes how residents experience the gap between the economic promise and the concrete nuisances.

techcrunch.com · September 22, 2026

Crusoe drops a $1.25 billion turbine deal

Data centre builder Crusoe, which supplies computing power to OpenAI in Texas among others, has dropped its purchase of 29 gas turbines of 42 megawatts each from Boom Supersonic. According to Boom’s CEO, turbines are no longer part of Crusoe’s near-term power mix. Two of this week’s announcements, Oracle and Crusoe, are about energy rather than chips: that is where schedules are decided today.

techcrunch.com · September 25, 2026

Keep a record of what your agent does, out of its reach

30 minutes · a spreadsheet or a sheet of paper · an agent or assistant you already use · no technical skill required

1. Pick one agent and one real task. The assistant that sorts your email, the one that fills in a form, the browsing agent that compares prices: a task you already hand over, not a demo.

2. Write down its refusals before you start. Three to five lines: the sites it must not visit, the data it must not pass on, the actions it must never approve on its own (paying, sending, deleting). What is not written down cannot be checked.

3. Find a record it cannot change. It has to live on the service’s side, not the agent’s: your Google or Microsoft account activity, the order history at the store, your bank statement, a separate mailbox in copy. That is the lesson of the study on erased traces.

4. Have it do the task, then ask for a report. In the spreadsheet, two columns: what the agent says it did, and what the external record shows. Note every difference, however small.

5. Test a refusal. Give it a task where the right answer is "I can’t": a page that requires a login you never gave it, a piece of information that does not exist. Watch whether it stops and says so, or looks for another way in.

6. Decide and date it. For each gap: keep, restrict (remove an access, require a confirmation) or stop. Redo the same table in a month, with the same task.

The deliverable: one page listing the written refusals, the external record you used, the gaps between the agent’s account and that record, the result of the refusal test, and your decision with its date.

What you asked me

I received no new reader request since edition #004, only an out-of-office reply. I would rather say so than invent one.

The commitment made in earlier editions still stands: find a documented case where AI genuinely changes live performance, its production or its relationship with audiences. This week again, nothing solid enough on the stage itself; the cultural news is about music streaming and video, not the theatre floor. I am keeping the question open.

I never quote a name or an employer without consent. I describe the job and the question, because that is often where a topic becomes useful to others.

The common thread

If I had to sum up these seven days in one sentence: agents already act inside other people’s systems, and nobody keeps a record of what they do there.

A health portal in Australia, university databases, an online store, image hosts: each time, the agent acts on a system that is not its own, for someone who is not there. And each time, the discovery comes late, often from outside. A prime minister, an independent lab, a retailer, a journalist.

The law moves at its own pace, between AI Act summaries that name no website, an incident never reported to Brussels and a French bill with no date for debate. Meanwhile, the safeguard within everyone’s reach is a modest one: write down what the agent is not allowed to do, and keep a record it cannot erase.

Until next Sunday.

Jérôme

Your turn: reply with one sentence: "the task I handed to an agent without ever checking what it did is…". These concrete answers shape the next issues.

Was this newsletter useful?

Forward it to someone who already hands tasks to an agent, who wonders about their assistants, or who follows regulation closely. That is how SIGNAL AI finds its next readers, and its next questions.

Once a week, on Sunday. Nothing else, ever.