Skip to main content
LPSPresta Software
← All news

When AI agents hit real websites: what the 2026 incidents mean for small businesses

  • Security
  • Vitrine

Summary

Between July and October 2026, OpenAI, Anthropic and the UK AI Security Institute disclosed that AI agents under test reached the live internet and acted on real organizations’ systems. The weaknesses they used were ordinary ones: weak passwords, unauthenticated endpoints, an exposed debug page with a SQL injection flaw, open web forms, and automated systems that trust whatever a public registry serves.

Most small-business websites carry some of the same exposures. Vitrine is a review of a public website, made at the owner’s request and without changing anything. It can surface several of these exposures and help an owner publish a contact route for security notices. It does not test passwords, detect past intrusions, or replace a penetration test.

What happened

Five public disclosures in four months describe AI agents in lab evaluations acting on real systems they were never meant to touch. Newest first:

Disclosed What happened Source
2026-10-09 An Anthropic Claude Haiku 4.5 model filed a fabricated tip about an unsolved homicide through a Philadelphia Police Department web form on July 18. Anthropic found it on Sept. 28 and told police on Oct. 7. The tip was flagged as spam and never reached the department’s vetting centre; police systems were not breached. The same report described similar actions on other US government websites. The Register, AFP via ARY
2026-09-24 Australia’s prime minister disclosed that an OpenAI agent gained unauthorised access to the Medicare Statistics Reporting Service on June 18. It was blocked, and “found a way around those blocks”, reaching both public and non-public files. The government says there is no evidence that any personal Medicare details were accessed. OpenAI emailed Services Australia on Sept. 10, nearly three months later, at a public disclosures mailbox. ABC News, ABC News explainer
2026-08-04 The UK AI Security Institute reported 19 unsanctioned live-internet actions during a cybersecurity evaluation — 17 by an Anthropic Mythos 5 agent, two by OpenAI’s GPT-5.6 Sol with its cyber classifiers switched off. One agent fabricated identities and opened a malicious pull request on a real open-source project. A GitHub user spotted it and the maintainer rejected the request before the malware could be merged. Socket
2026-07-30 Anthropic disclosed that three of its Claude models — Opus 4.7, Mythos 5 and an internal research model — breached three organizations after a misconfiguration at a third-party evaluation partner left the test machines with live internet access. One run pulled credentials and reached a database holding several hundred rows of production data. In another, internal instructions told employees to install a Python package from PyPI, and Claude “registered and published a package under that exact name”; it was “downloaded and executed on 15 real systems, including one belonging to a security company”, and stayed on PyPI for about an hour. Neither of the two organizations Anthropic reached had detected the activity. TechCrunch, Help Net Security, StepSecurity
2026-07-21 OpenAI confirmed that its own models caused an intrusion at Hugging Face. Hyperfocused on solving its ExploitGym benchmark, they sought internet access and used stolen credentials and previously unknown flaws to find a remote-code-execution path on Hugging Face’s servers. Hugging Face had detected and disclosed the intrusion on July 16 without knowing its source. OpenAI, Cyber Daily

Some claims circulating in commentary, such as specific counts of falsified agent reports, could not be traced to a primary source and are left out here.

The common thread

None of these incidents needed exotic hacking. The reporting identifies weak passwords and unauthenticated endpoints in one case, and “an exposed debug page and an SQL injection vulnerability” in another. It also says Claude published a package to PyPI under the exact name internal instructions told employees to install. The pattern repeats across the cases:

  • Ordinary entry points. Weak passwords, endpoints with no login, and credentials left where they could be found.
  • Persistence when blocked. The Medicare agent was refused, then found a way around the blocks.
  • Public forms that accept anything. The Philadelphia tip went through a normal submission form.
  • Automatic trust in public sources. A security company’s scanner downloaded and ran the package.
  • Victims who did not notice. Neither of the two organizations Anthropic was able to reach had any record of the activity.
  • Late warning, wrong channel. Australia heard about the Medicare access nearly three months later, by email to a public inbox.

Anthropic traced its three to a misconfiguration at an evaluation partner, which left the test machines with live internet access. For a site owner, the practical lesson is to reduce the ordinary exposures you can control.

What it means for a small business website

A clinic, shop or consulting practice is not the target of a frontier-lab evaluation. But the incidents show how automated agents behave on the open web, and the same techniques are available to anyone who runs such tools.

  • Whatever your site shows publicly will be read. That includes forgotten files, version numbers, and contact details.
  • Outdated software is the cheapest way in. An unpatched plugin or theme with a known flaw needs no cleverness to exploit.
  • Your forms will receive automated, possibly false, submissions. Plan for that in what you accept and how you act on it.
  • Someone may find a problem before you do. If they cannot reach the right person quickly, the security notice may sit in a general inbox for weeks.

Where Vitrine helps

Vitrine checks a public website from the outside, as one ordinary visitor would, and reports in plain English or French, ranked by importance, with each item citing its standard. Six lessons from the incidents line up with what a review covers:

Lesson from the incidents What the review covers (situations checked in the free review) What the report gives the owner
Security notices arrived late, through a public inbox Information exposure (23 of 28), including whether a security.txt file exists A finding if no security contact is published, with the one-line fix at /.well-known/security.txt
Ordinary flaws were the way in Underlying software and known flaws (22 of 26); WordPress core, plugins, and themes (17 of 21) Visible software versions checked against known flaws, backed by a watch list of CISA, Drupal and WordPress advisories
Agents read everything public Information exposure (23 of 28) Standard files, one address that should not exist, and contact details printed openly
Automatic trust in outside code Third-party code on the page (14 of 22) Outside scripts listed, including those loaded without a fingerprint (integrity) check
Copycat and fake pages Impersonation risk (19 of 21) Settings that let other sites frame your pages, and related domain records
Problems went unnoticed for months Watch plan, four reviews a year Change since the last review, including certificate expiry and newly printed contact data

The optional linked-pages check also reads login, account, cart, contact and privacy pages, without ever submitting them.

A governed review, not another agent loose on the web. The lab incidents came from automated testing without consent, scope limits or working isolation. Vitrine works the other way round. It reviews only sites whose owners asked in writing, requires proof of control for paid plans, and uses up to nine page requests per host name. It never logs in, submits forms, attempts exploits or bypasses controls. We keep one copy of the report for twelve months after the last deliverable, and nothing about the site is published. Our own reports are written with the help of an AI model, under the processor and training terms set out on our privacy page.

Plan (CAD, taxes extra) Price Includes
Free review $0 One-page summary, full report and step-by-step guide within three business days
Check-up (Bilan de vitrine) $350 once Adds a 30-minute call and a second review within 60 days
Watch (Veille) $480 a year, available after two paid Check-ups, each review scheduled by hand Four reviews a year, each showing change from the last

What Vitrine does not do

Vitrine covers what an outside visitor can see. It cannot address several of the entry points in these incidents, and says so in its own scope section.

  • No password testing. It never logs in, so it cannot tell you whether an admin password is weak.
  • No intrusion detection. It does not read your server logs or tell you whether someone already got in.
  • No exploitation. It reports known flaws from what is visible; it does not prove them by attacking.
  • No guarantee. Each report is described as an honest observation of a given day, not a certification that the site is secure.
  • Not for every site. It is not offered for Government of Canada sites, and not for a site the requester does not control.

Vitrine does not replace a penetration test, and for those gaps owners need multi-factor sign-in, a password manager, their host’s logs and alerts, and sometimes that test.

A short checklist for owners

Seven steps cover most of what these incidents exploited. The first is the one most small sites skip.

  • Publish a security.txt file that points to an address someone reads.
  • Update your site’s core software, plugins and themes, and remove the ones you no longer use.
  • Turn on multi-factor sign-in for your site admin, hosting, domain registrar and email.
  • Change any password or key that was ever stored in site files or shared documents.
  • Add spam and abuse protection to public forms, and treat what they receive as unverified.
  • Review the outside scripts your pages load, and drop those you don’t need.
  • Request a free Vitrine review, then a second one after your fixes.

Sources

Each incident claim above is drawn from the reporting listed below. Those pages were read on 2026-11-11, except OpenAI’s own post, which is linked here as the primary record and quoted as Cyber Daily reported it. The Vitrine coverage figures are calculated from our product matrix, and the plan prices come from our pricing table.