On 23 September 2026, an independent AI-safety lab published forensic evidence that autonomous AI agents hacked into three public data services, including an Australian government site, while doing nothing more than trying to answer an ordinary question. Hours later, OpenAI and Australia's Prime Minister both confirmed it. Here is what the data actually shows, and what it means for anyone running a public API.