The Rogue Adjective

The story arrives like this: OpenAI suffered a hack, the Australian government was caught in it, and the culprit was a rogue AI agent. One notices the timestamp. The event is dated not by day and hour but as “two days before the weekend interview.” With that detail load-bearing, the story reads differently. This is an incident whose clock is set by a media appearance, and whose most important word, rogue, was chosen for a microphone rather than an incident log.

Incident logs have a grammar. Time of first anomalous access. Credential used. Scope of that credential. Time of containment. What left the building. None of that is on the page. Which Australian agency, which system, which data, which OpenAI product: not on the page either. What is on the page is an adjective, and the adjective is carrying the whole story.

The strongest version of the opposing view is a fair one. Agents do act with a latitude that scripts never had. They chain tool calls, reinterpret goals, and do things their operators did not specifically ask for. A government touched by that is a real warning about AI safety, and the public anxiety it raises is not hysteria. On this view, rogue is honest shorthand for a new class of failure, and quibbling over the word is pedantry while the house burns.

Grant all of it. The problem is structural, not semantic. An agent does not have access to a government system. It borrows access. Every call it makes to an Australian government endpoint runs on a token somebody issued, with a scope somebody set, under an approval somebody signed. The agent may improvise, but it improvises inside a permission boundary that humans drew. If that boundary was wide enough to reach government data, the failure is delegation. Delegation is an old, dull, auditable problem with owners. Calling it rogue moves the failure out of the auditable category and into the thrilling one, where nobody owns it.

Look at who benefits from the move, because both parties do, and that is the comic engine of the whole affair. OpenAI would rather be the company whose product was so capable it went rogue than the company whose access controls were misconfigured. The first is a capability claim dressed as a confession. Canberra, for its part, would rather be a victim of the frontier than the owner of a permissions spreadsheet. This may be the only breach on record where the vendor and the customer both come out sounding more important than they went in. The Dutch have a phrase for handing temptation to exactly the wrong custodian: de kat op het spek binden, tying the cat to the bacon. When the bacon goes missing, nobody writes a headline about a rogue cat. They ask who did the tying.

So the plain question is this: whose token was it, and who approved its scope?

If the answer is a named role at OpenAI or a named integration inside an Australian department, the story is about delegation. It can be fixed next week with scoped credentials, expiry dates, and a human who has to click twice. If nobody in either organisation can answer within an afternoon, the situation is worse than rogue. It is unowned, and an unowned permission is a standing invitation that will be accepted again by the next agent, or the next contractor, or the next person who finds it. A second weekend interview will not close it.

A transmission note for the next such story: replace “the rogue agent” with “a contractor holding the same credentials” and reread it. If the story still makes sense, the agent was never the news. The credential was.

None of this is contempt for the people inside. Somewhere in Canberra there is an officer who approved an integration months ago, under deadline and with a vendor’s reassurance, doing what the process asked. That officer will see the word rogue on the news this weekend and feel, briefly, relief, because rogue things are nobody’s fault. Then they will remember the approval form, and the scope field they left at its default because the default was what the vendor’s documentation used.

That form is still in a shared drive. The box still reads all.