Fun fact (or not): Somewhere right now, an AI inference server is sitting on the Internet with no authentication, wrapping a frontier model, waiting to be found.
Give an AI agent a goal and a denied request will look like an obstacle to route around, not a stop sign. In the words of Anthony Albanese following the recent Medicare incident: “There were blocks clearly which were coming backtelling the AI agent, ‘no’. The AI agent found a way around those blocks.”.
A security researcher puts it plainly: if one of the best-resourced AI labs in the world can't see its own agent poking at a third-party system in real time, most organisations should assume they have the same blind spot, just untested. How? These non-human agents are making rapid, polite, well-formed requests from cloud infrastructure, which does not trip detection signatures tuned for human-shaped threats.
In the old days, a threat actor would hunt for zero-days or exploits known vulnerabilities to gain unauthorised access to a target system and infrastructure.
In 2026, a stealth agentic AI can find zero-day vulnerabilities, chain together multiple vulnerabilities, and devise novel attack paths to escalate privileges and move laterally as needed.
In May 2026, researchers from Intruder scanned over 2 million exposed AI services and found around a million were "more vulnerable, exposed, and misconfigured than any other software" ever investigated. Each is an incident waiting to happen.
The Australian Signals Directorate has been unambiguous: frontier AI changes the threat landscape, but it doesn't retire the fundamentals. ASD's advice is to adopt a "patch every day" mentality, and to apply patches regardless of severity rating. ASD’s reasoning: low-severity issues can be used together for highly effective attack chaining. Organisations can also minimise attack paths through segmentation, restricting network access and questioning whether external connectivity is necessary at all.
These are not new advisories. It is the same advice that prompted the creation of the (soon to be retired) Essential Eight: patch applications, patch operating systems, and restrict administrative privileges to protect Internet-connected information technology networks.
Thinking that Artificial Intelligence is just another “tool” exempted from asset management, vulnerability management, or change control, is just the excuse for a breach waiting to be found.
What can you do?
- Inventory – Every AI deployment should be accounted for especially where internet facing, not as a side project exempt from your asset register.
- Patch every day - Treat AI framework vulnerabilities with the same urgency as any other internet-facing system.
- Segmentation – Ask your IT, Security or MSSP whether your AI stack can reach sensitive data or critical systems directly, and challenge that access if it can.
- Tune detection – Artificial Intelligence is not just another “tool”, monitor accounts for agentic traffic.
