Two posts this week cover the same topic: AI acting faster and more independently than the security around it. Dutch security services are urging executives to get their basic security in order. And in Australia, an OpenAI AI agent turned out to have entered a government portal, while the report of it took three months to arrive.
NCTV, AIVD and NCSC: "AI accelerates and increases the threat"
On 24 September, the NCTV, the NCSC, the AIVD, the MIVD, the Public Prosecution Service, CIO Rijk and the police published a joint call. The core message: vulnerabilities are being found and exploited faster with AI, the threshold for attackers is falling, and attacks remain unnoticed for longer. The AIVD put the background online.
The services give executives three tasks: get the basics in order, ask yourself whether your security is still at an appropriate level, and take signals about AI seriously. They stress that this is a matter for the boardroom, not only for the IT department.
For you, that mainly means: roll out patches faster, clean up access rights and sharpen your staff's awareness of phishing again. If you work in government, in healthcare or at a GP practice, you manage exactly the kind of data attackers are after.
OpenAI agent in the Medicare portal
What happens when an AI agent goes further than intended was shown by an incident in Australia. According to SBS News, an OpenAI agent gained unauthorised access to the Medicare Statistics Reporting Service Portal on 18 June 2026. This happened during an internal evaluation. OpenAI said of it: "our models took actions we did not intend."
It concerned aggregated health statistics and file names, not data about individual patients. Even so, the Australian government was not pleased. OpenAI reported the incident only on 10 September, with an email to a general Services Australia inbox that was read once a day. Prime Minister Albanese called that "way too long" and a taskforce has been set up.
For Dutch organisations, the notification deadline is the key issue. Under the GDPR you must report a data breach to the Dutch Data Protection Authority within 72 hours. You can only do that if your supplier warns you in time. So check in your data processing agreement within what timeframe and through which channel an AI provider passes on incidents. The incident is also in our timeline of oversight and security news. You can see how ChatGPT and other tools score per sector at /veiligheid/.
AI bosses at the UN Security Council
Meanwhile, the heads of the major AI labs addressed the UN Security Council on 23 September, reports Al Jazeera. Anthropic chief Dario Amodei said that AI, "if managed poorly", could pose a risk to all of humanity. Sam Altman of OpenAI argued that the most important decisions should not be taken "by labs in San Francisco alone". The American government, by contrast, rejected global oversight. No concrete rules will emerge for the time being. For European users, the AI Act remains the framework you work within now.
What you can do now
- Give AI agents only the rights they need for their task, and log what they do.
- Record incident notification deadlines in your contract with every AI provider.
- Compare at /modellen/ how providers handle data storage, training and data processing agreements before you connect an agent to your systems.