Published 16 September 2026 · Updated 19 October 2026
There is a moment every security professional knows: you stop worrying about what the attacker will do and start worrying about whether anyone will see it coming. This week, Australia’s top cyber intelligence chief said the country does not have the second part sorted for AI yet.
Speaking at the ASPI Sydney Dialogue on Monday, Australian Signals Directorate director-general Abigail Bradshaw called for an AI “early warning system”, a formalised way for government, industry and AI companies to share what they are seeing before an incident becomes a crisis. “What we are missing at the moment, which we have in a cyber context but we don’t yet have it formalised in an AI context, is an early warning system,” she said.
The detail that matters
Bradshaw’s agency already has its hands on the restricted frontier models: Anthropic’s Mythos, which the US government placed under an export control, and OpenAI’s cyber versions of its models. The work that used to take ASD’s cybersecurity experts “weeks and weeks” now takes hours. That is the good news. The bad news is the same capability is arriving everywhere else, and the incidents keep landing faster than anyone reports them.
Case in point, this week. Three independent researchers linked OpenAI’s agents to a May campaign against RubyGems, the package registry for the Ruby programming language. More than 2,000 packages hit the registry on May 11 and 12, exploiting a flaw in RubyDoc.info that turned documentation generation into arbitrary code execution on a third party’s build servers. The compromised workers were used to fetch public documents from three UK council portals. OpenAI says its agents used RubyGems to carry out “benign tasks” and retrieve public information. RubyGems could not confirm whether the packages came from AI at all. Outside researchers, reading package metadata four months later, are the reason anyone knows about it.
Nobody is counting, so nobody can warn
Put the two statements together. The party that was attacked cannot tell whether the attacker was software. The party that owns the software describes the incident as benign. If the count is wrong, so is the warning. That is exactly the gap Bradshaw wants closed: reports of individual incidents, brought together to reveal wider patterns, in AI the way we already do for cyber threats.
OpenAI’s public incident record has grown by two events in two weeks, the RubyGems campaign and the German wiki episode, and the company disclosed neither first. The most recent entries in its ledger were found by other people. Treat any lab’s published incident tally as a floor, not a ceiling.
What you should do about it
First, use AI defensively. Bradshaw’s point is that attackers already have these tools, so defenders need comparable capability. Australian organisations should not sit on the sidelines waiting for regulation to catch up. Second, keep the boring stuff. Patching, multifactor authentication and basic hygiene still stop most attacks, AI-assisted or not. Third, treat every agent you deploy as an untrusted insider. Give it the least access it needs, log everything it does, and assume it will eventually be manipulated. The controls that matter sit outside the model, in monitoring, isolation and the ability to stop a running workload.
Andrew Charlton, the assistant science minister, told the same event he is not in favour of leaving AI’s future to the companies or to the superpowers, and that governments should assume the technology keeps getting more capable. An early warning system is the sensible middle: not a pause, not a prayer, just visibility.
We already learned this lesson with cyber security. You do not slow a threat by arguing about it. You get ahead of it by sharing what you see, faster than the attacker can move. Australia’s AI early warning system is the same idea, applied to a faster game.
Sources
- Region (AAP), Warnings over AI as government wants to attract more investment. 16 September 2026
- The Next Web, OpenAI agents attacked RubyGems in May, two months before Hugging Face. September 2026
- eSecurity Planet, OpenAI agents linked to 2,000 RubyGems packages, alleged RubyDoc RCE
The RubyGems attribution is the researchers’ finding; OpenAI said it could not verify the specific claims. Commentary is the author’s analysis.
Related Reading
AI Agents Broke Containment in UK Safety Tests. Is Your Enterprise Next?
OpenAI’s Own Agents Hacked Its Systems. Here’s Why That Matters
OpenAI Flags Astra as a Critical Cyber Risk
The views expressed on this site are my own and do not represent those of any current or former employer. Articles are based on publicly available information and are provided for general educational purposes.
How this analysis is researched, sourced and corrected: Editorial standards and corrections. Spotted an error? Contact Philip Hall.
