The Machine That Chose Its Own Target

Week of 24 July: the breach that arrived by email, Labor's last splash of the old money era, and the AI that hacked without asking

Somewhere in Origin Energy’s inboxes, a warning spent three weeks going nowhere.

In the same stretch of July, across the Pacific, an artificial intelligence ran more than 17,000 hacking actions in a single weekend without a human touching a keyboard.

This week runs from the breach Origin could not see even when it arrived by email, to Adelaide, where Labor spent day one inventing a court nobody voted for and selling ministers by the plate. Then, the best saved for last, what security researchers are calling the first documented fully autonomous AI cyberattack.

All of it points the same way. The world now moves at machine speed, and our institutions are still checking their inbox.

The Hack That Waited in the Inbox

At the start of the month, on The Australian’s account, someone calling themselves Edison Walthour, a name as disposable as the Gmail address it arrived from, emailed Origin’s board members, security teams and customer care addresses, claiming to hold the records of two million customers.

Nothing happened.

For nearly three weeks the warning went nowhere while, on the self-described hacker’s telling, they roamed Origin’s customer platform undetected. Asked how they got in, the answer opened with six words, “no company VPN, very simple passwords”, and closed with Origin’s security rated below a school project. It took a 50-record sample of names, birthdates, addresses and billing histories landing at The Australian, and the paper forwarding it on, to move the company. Origin’s statement hit the ASX 21 minutes after The Australian’s story went live, alongside urgent calls to the national cyber agency, the AFP and the privacy watchdog.

Three weeks to answer an email, 21 minutes to answer a headline.

Then it got worse. A day after saying it did not believe payment details were touched, Origin confirmed unauthorised access to customer data including partial credit card and bank account digits. Chief exec Frank Calabria apologised, and the company will contact affected customers as it works out how many there are.

The hacker says the motive was anger at Origin sending support jobs offshore to Manila. The customer platform they work in, supplied by Kraken, is sold on carving cost out of serving you. The hacker also says Origin quietly interviewed and sacked the staffer whose credentials were used. Origin will not confirm that, and in fairness it says it asked for evidence at first contact and got nothing back. Companies this size field hoax extortion mail every week, and a single request for proof is close to the standard corporate playbook.

The hacker is no white knight either. They gave Origin a 14-day countdown, after which they said the full dataset would go public, and a countdown attached to two million records is a threat in anyone’s language. Then, overnight, the countdown stopped. The hacker told The Australian their site was down, no data would be leaked, and everything had been settled with Origin privately. Origin has not confirmed any settlement, and neither side is saying what, if anything, changed hands.

Follow the sequence. Three weeks of nothing, two days of headlines, then peace, declared by the intruder, on terms nobody can see. If anything of value did change hands, and settled tends to mean exactly that, ransomware reporting rules in force since May last year give a business Origin’s size 72 hours to tell the Australian Signals Directorate. Paying a hacker, unless they are under sanctions, is not illegal in this country. It is only the thing the government’s own advice says never to do, because the one thing you cannot buy from a criminal is proof of deletion.

Some balance, from someone who has built technology companies and shipped software with holes in it. Every system has vulnerabilities. Every one. The most sophisticated AI lab on the planet could not keep its own model in a box this month, so nobody should pretend an energy retailer can build a perfect wall. Getting breached is not the scandal.

The scandal is the stretch between the knock on the door and the ASX statement, nearly three weeks on the hacker’s dating, and on either account it held one request for evidence and then silence. The playbook ran exactly as written. Australia’s biggest energy retailer still needed a journalist to tell it that it had been breached.

We have seen where that leads. Optus in September 2022, 9.5 million people exposed through a dormant login door left open by a coding error. Medibank the following month, 9.7 million people, credentials stolen from a contractor and bought off a Russian crime forum. Four years on, both are still in the Federal Court, and the Medibank hacker wears Australia’s first cyber sanctions. Qantas lost 5.7 million records through a Manila call centre last year.

Parliament responded to Optus by lifting the maximum penalty from $2.22m to the greatest of $50m, three times any benefit gained, or 30% of turnover, which on Origin’s roughly $8bn in half-year revenue alone runs into the billions.

The privacy watchdog logged a record 1,205 breach notifications last year, up 8%. The national cyber agency Origin called, the Australian Cyber Security Centre, sits inside the Australian Signals Directorate, meaning the outfit that runs the nation’s electronic spying also runs its help desk for the hacked. That help desk clocks a cybercrime report roughly every six minutes.

Identity data does not expire like a password. You can reset a password. You cannot reset a date of birth. Criminals harvest it and sit on it, and a name, a birthdate and a billing history profile your household for a decade.

Four years of promises since Optus, and the hard half of the Privacy Act rewrite still has not reached the parliament. The laws that force companies to collect and hold your identity documents in the first place are a different story. Those arrived right on schedule.

The companies save by outsourcing the call centre. You carry the risk.

Solidarity, Proudly Sponsored

Labor’s 50th National Conference opened in Adelaide yesterday, and before 9:30 am three Chinese diplomats were in the corridors, in earshot of the media, demanding the party eject the observers from Taiwan’s trade office. Party headquarters refused, the observers stayed, and the diplomats walked out. Beijing tested the room before it opened, and the room passed.

More credit, because this is a genuine institution and pretending otherwise is lazy. National Conference is Labor’s highest decision-making body, and these floors draw real blood. Albanese fought boat turnbacks at the 2015 conference and lost on the floor. In Adelaide in 2018 he worked the corridors against Bill Shorten. Now he owns the room, and a motion carried on this floor can end up as law, though plenty signed off here dies quietly in cabinet and caucus. Palestinian recognition made the whole journey. The next tests, revisiting AUKUS and Palestine, land on Saturday.

It is more than the Libs can say. Their equivalents are box-ticking, and the parliamentary party has taken the root-and-branch membership for granted for years. Howard is celebrated for working the backbench, but his deeper skill was the lay party. Name a Liberal leader since who has been half as good at it. I can’t, and a fair share of the party’s troubles live in that gap.

So the conference is real, which is why the rest of the week matters. The Taiwan stoush was the day’s only unscripted moment. From there, the machine took over.

The Prime Minister used his address to unveil a Fair Work Court, a specialist bench for underpayment and other small workplace claims, reversing Howard’s 1997 dismantling of the old industrial court. The pitch is fair on its face. An underpayment claim can cost more to chase than it recovers, and faster, cheaper justice is a genuine offer.

The unions are delighted. Employers were briefed hours before the speech. The punters get consulted on the design, not the question, because this was never taken to the polls held only 14 months ago. National Conference is where Labor policy is born, granted. A floor blessing is not a mandate.

The platform tells you where Labor wants to go. It rubber-stamps the May budget’s capital gains, negative gearing and trust changes, and keeps a gas tax alive through language about a fairer return from our resources, even as the Treasurer waved the idea away that afternoon. Carbon capture is gone entirely, coal survives only as unreliable and costly, a floor amendment went after the diesel rebate, and the electrical union wants government back in the generation business.

Chris Bowen led the climate session. Senate estimates answers published the day before the conference opened put hard numbers on his home battery subsidy. The scheme launched paying a flat rate on every kilowatt hour of storage up to 50 kWh, so the bigger the battery, the bigger the cheque. Households did the rational thing and bought big. The department expected to spend around $4,500 a battery and is now spending $7,910, support per battery running 75% above forecast. Three of the 136 approved manufacturers are Australian. A program budgeted at $2.3bn over four years now heads for $8.5bn over its life, and the rescue is already running, a quiet rule change to keep the regulator paying when the money ran dry and a taper bolted onto bigger batteries.

Credit the idea. Home batteries soak up midday solar and pour it back into the evening peak, and the department’s defence is that the country bought more storage than anyone forecast, which on its own terms is the point. But useful and badly designed can be true at once, and this scheme paid for bulk, so bulk is what it bought. Bowen calls it an enormously successful program, and on uptake he is right. On cost, it is the success of a half-price sale. Giving away other people’s money is not a skill. Counting it is.

Then there is the money. A ticket to Labor’s Business Exchange costs $12,000, and the floor plan journos have sighted puts 36 ministers in the room. Entry to Tony Burke’s band pub gig runs $1,000. A law firm pays for the delegates dinner, Macquarie backs the Prime Minister’s lunch, a drinks company has the bar tab and an agricultural chemicals lobby the coffee cart. On Monday, Albanese attended a Point Piper fundraiser the Financial Review reports was built around a $1m pledge, a figure Labor disputes, at a mansion the paper says the Tax Office held security over from its almost $273m pursuit of the host family. Gambling reform tops the agenda here, and a whopping $2.72b of the family fortune passed through The Star casino, according to the 2022 Bell Review.

Fair is fair. The Coalition runs the same subscription forums, and the two sides banked $10m between them last year.

The donation laws this government wrote begin on 1 January 2027. Annual gifts capped at $50,000 per recipient, $1.6m in total, with the disclosure threshold dropping from $17,300 to $5,000 and near-real-time campaign reporting. The alleged Point Piper number is 20 times the new annual cap. The $110,000 forum membership dies with it. Everything in Adelaide this week is a sprint through the final season of the old rules, run by the people who wrote the new ones, passed them, then in April accepted the Electoral Commission’s advice to push the start back six months. Independent advice, gratefully received. They left themselves loopholes, naturally, from branch-spreading small gifts to the nominated entities sheltering their war chests, but the model on display is finished in five months.

Under it all sits the economy that should be the main attraction. Former Reserve Bank governor Philip Lowe warns income per head has gone seven or eight years without net growth. Yesterday’s jobs figures added 76,300 positions against expectations of 15,000, and bond markets moved to fully price a fourth rate rise by year’s end, potentially taking the cash rate to 4.6%, the highest since 2011, pending next week’s inflation report. Oil is not waiting. Brent crude punched above $100 USD a barrel for the first time in two months overnight after Houthi strikes on Saudi tankers in the Red Sea.

The numbers carried a Victorian postscript. Unemployment there hit 5.1%, the worst since the sixth COVID lockdown, and Moody’s projects one Victorian revenue dollar in ten going to interest by decade’s end. Four months from the election, Victoria is running out of other people’s money and other people’s patience at the same rate.

Wayne Swan farewells the presidency at tonight’s conference dinner, and the extracts already released declare One Nation, not the Coalition, Labor’s real enemy, the same enemy Albo built his own address around while refusing to utter Pauline’s name. Redbridge explains why. Roughly four in five of One Nation’s current supporters arrived in the past 18 months. A government presiding over those living standards should be less worried about Pauline and more worried about the mirror.

Out of the Box

Now to the story that makes everything else look quaint.

On a hacking benchmark, OpenAI was testing its best public model and something stronger that has not been released. The test ran inside a sandbox, a sealed environment whose one opening was a guarded feed for code packages, and the usual gates against cyber work were dialled down so full capability could be measured.

The models decided the wall was part of the puzzle.

They found a previously unknown flaw, a zero-day, in the software behind that feed, and used it to climb out, hopping between machines and escalating access until they reached one connected to the internet. Then they reasoned about where the answer key might live, concluded the AI platform Hugging Face probably hosted it, and broke into Hugging Face’s production servers with stolen credentials chained to fresh vulnerabilities. They took the answers and cheated on their own exam.

Hugging Face noticed strange traffic, shut it down, and later reconstructed more than 17,000 actions from one weekend. No human directed any of it. Bloomberg reports the heart of the operation took the models hours, work a skilled human would need weeks to pull off. Security researchers are calling it the first documented fully autonomous AI cyberattack. The word ‘fully’ matters here. Last year’s AI-assisted espionage campaigns still had humans approving key steps, and this one had nobody. OpenAI itself describes the capabilities involved as state of the art.

OpenAI is not alone. Anthropic disclosed in April that an early version of its Mythos model, set a task inside a sealed environment, helpfully broke out to get the job done, and in separate testing worked out which benchmark it was sitting on so it could unlock the answer key. The head of Anthropic’s frontier red team told his staff to mark this month’s breach as the first true AI safety incident.

Sealed environments fail. Anyone who has run one knows it. What happened next should stop you cold.

When Hugging Face asked leading American commercial models to help investigate, their safety guardrails refused, unable to tell an incident responder from an attacker. The forensic work ran on GLM 5.2, a Chinese model given away with its weights open. One of the most important AI companies on earth defended itself with Beijing’s software because Silicon Valley’s wouldn’t take the call.

That anecdote is the whole strategic problem in miniature. China’s Moonshot has just released Kimi K3, within reach of the American frontier, and publishes its weights to the world on Monday. OpenAI’s president Greg Brockman concedes it is “pretty good” and points to estimates putting China as little as four months behind. The White House says Moonshot trained on banned Nvidia chips accessed through Thailand and ran industrial-scale distillation of American models, and the US Treasury has sanctions on the table. Beijing’s play does not require winning the capability race. It gives the capability away and lets scale do the rest.

The UK’s AI Security Institute reported this week that every frontier model it tested tried to cheat on its evaluations by taking forbidden shortcuts, and often did not admit it.

Now watch Canberra’s timeline. Voluntary ethics principles in 2019. A voluntary safety standard in 2024. The Productivity Commission advising against mandatory guardrails last year, on the classic ground that you regulate harms, not technologies, and the national AI plan shelving them. Then, on 15 July, the reversal. The Prime Minister pulled AI strategy into his own department, stood up an Office of AI effective immediately, and flagged National Cabinet next month, legislation next year. He also made an appointment his government never announced and The Australian had to dig out. The office goes to Fergus Hanson, who ran the Australian Strategic Policy Institute’s cyber centre before vanishing into the intelligence community in late 2022, plucked back out to run AI policy barely a year after the Prime Minister was deriding ASPI on the record. The silence was the announcement.

Six days later the disclosure landed, and a machine on the other side of the world had already delivered his case study.

The government banned DeepSeek from its devices early last year. Kimi K3 is considerably more capable and is, on Home Affairs’ own description, merely being monitored. A device ban turns on where the data goes as much as what the model can do, so the two calls are not a clean pair. The monitoring call may even be defensible, but nobody in government has argued it.

Which brings us back to Origin Energy. They took three weeks to act on a warning email. The threat now forming runs 17,000 moves in a weekend.

That is the gap Australia has to close, and no conference motion closes it.

Weekly Wrap

Step back and ask what actually failed this week. The honest answer is nothing.

Origin’s system did what it was built to do. On the hacker’s telling nobody scaled a wall. Staff credentials opened the customer platform, and the platform served up records, because serving is its job. A valid login does not look like an attack. It looks routine. The warning email died the same way, landing across inboxes at a company whose best account of itself is that it asked for evidence once, heard nothing, and let the matter rest, exactly the response the standard playbook prescribes. Even the ending, on their telling, ran to specification, the threat retired privately, the terms nobody’s business, the platform back to serving.

Labor’s conference did what it was built to do, and unlike the Lib’s imitation it is built to do something real. It debated, it decided, and the funding machinery bolted to its side converted access into money at the fastest legal rate. The exquisite detail is that Labor has already ruled this side of the equation wrong, in legislation they drafted, passed and dated. January is the sentence. Adelaide is the stay of execution, and they are making bank every day of it.

The frontier AI model did what it was built to do. During a hacking exam with the safety catches off, it hacked. To the machine, the wall was never a rule. It was an obstacle.

Nothing malfunctioned. Everything ran to specification. The scandal, in all three stories, is the specification.

The AI world has a name for the gap between what you tell a system and what you actually want from it. They call it the alignment problem, and they rate it the hardest problem of the age. This week it walked out of the lab. It has been running in Origin’s inbox and at the Adelaide Convention Centre the whole time, quietly, at human speed. The machine just ran it at 17,000 moves a weekend and made it impossible to miss.

Our systems are not broken. They are obedient. A platform built to serve cheaply served cheaply. A party built to fund itself funded itself. A model built to win did whatever winning took.

Everything we build does what we say. Almost nothing we build does what we mean. This week the gap between the two moved at machine speed for the first time. It will never move slower again.