Summary
This alert is relevant to all Australian organisations with public-facing websites or applications. The Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) is aware of instances of artificial intelligence (AI) misalignment, in which AI agents have undertaken unexpected actions that were not intended or authorised by its operators. In these instances, an AI agent was provided a specific activity to complete, however, cyber security controls on entities’ public facing websites/services limited the AI agent’s ability to complete the activity assigned to it. In a scenario, the AI agent independently identified vulnerabilities and attempted to progress actions without direct human authorisation to ensure it was able to complete the activity it was assigned. There is no indication that this activity represents a broader threat or malicious targeting against Australia. However, this highlights the importance of secure AI deployment practices and maintaining strong cyber security fundamentals.