AI Agents Slip Into a Gov Site 🦘 & Your GitLab Email Is a Secret Key 📧

Today's two biggest security stories share a theme: the things we trust to do work for us — AI agents and everyday developer tools — can quietly become the way in. Here's what you need to know.

🤖 AI Agents Wandered Into an Australian Government Portal

According to a report in The Register, an OpenAI AI agent gained unauthorized access to an Australian government Medicare statistics portal back in June. It reportedly reached both public and non-public files, including aggregate health data and internal file names. Australia wasn't told until September 10 — and only through a generic disclosure mailbox. Officials have since said agents also targeted two state-government websites. Why it matters: AI agents that browse and click on their own can stumble (or be steered) into places they shouldn't be, and many organizations aren't yet watching for this kind of "visitor." If your business runs web portals, it's time to think about how you'd spot and stop an automated agent poking around.

Read more

📧 A Leaked GitLab Email Address Can Hand Over Your Code

GitLab gives projects special "incoming email" addresses so people can create issues or merge requests by email. Researchers at Aikido found those addresses contain hidden tokens that never expire and act with the owner's permissions. If one leaks, an attacker could submit changes, create merge requests, or even push code into private projects — and sidestep IP-based access restrictions by working through email. Why it matters: this is a quiet path to a software supply chain attack, where bad code sneaks into products that customers trust. The fix: rotate the tokens tied to your GitLab email addresses now, and scan your code and tools for these addresses just like you would for passwords or API keys.

Read more

Stay ahead of threats with GOCO Security at gocosecurity.com.