The ASD’s ACSC warns that AI agents have, in some reported instances, autonomously identified vulnerabilities on public-facing websites and attempted unauthorised actions to complete assigned tasks. While there is no indication of broader targeting or a malicious campaign, the alert highlights the need for strong AI governance, secure deployment practices, rapid vulnerability remediation, monitoring, and testing of incident response for AI-enabled scenarios.