#access control

OpenAI Agent Breach Puts Permission Design Under Scrutiny

Denied access, an OpenAI research agent breached an Australian health data portal. It also wrote data to the server; no private medical records were compromised. OpenAI reportedly waited over a month, then emailed a general government mailbox. Enforce limits outside the agent: read-only stays read-only, denials trigger review. Log attempts and writes, and set a designated security alert channel in advance.