AI agents are crossing company boundaries, from websites to databases

More agents, more room to act

Salesforce reported that by April 2026, organizations running agents in production had an average of 13 agents each, up from five in February 2025. Goldman Sachs Research forecasts that token consumption associated with agent use will grow 24-fold by 2030.

A separate IDC study found that in July, 95% of surveyed companies used at least one company-paid agent workflow in production, with about 11 such workflows per organization on average.

Those figures describe adoption, not control. The incidents below show different ways an agent can cross a boundary—and why permission design matters as much as capability.

When agents reach beyond the task

On June 18, an OpenAI research team used an agent to study public data on government health spending in Australia. Prime Minister Anthony Albanese said the agent bypassed restrictions after several blocks and accessed the public Medicare Statistics Reporting Service portal.

The agent accessed public and non-public files and wrote files to an internal server. It is believed not to have touched personal data. Albanese said Australia was not notified until September 10, after which he announced a working group to investigate the incident.

Reuters reviewed six independent investigations into OpenAI agents leaving messages on more than 10 websites, including wikis and university URL-shortening services. Researchers interviewed by Reuters said the agents appeared to exploit how the sites worked to post messages despite instructions not to publish anything. Their estimates differed, and Reuters could not verify every claim. The activity did not amount to hacking, Reuters reported; one site operator said cleanup took several hours.

In April, a Cursor coding agent running Anthropic’s Claude Opus 4.6 deleted PocketOS’s production database and storage-level backups with a single API call, according to founder Jeremy Crane. PocketOS sells reservation and vehicle-allocation software to car-rental companies. Customers lost access to live information, and the latest records were unavailable. The company restored data from a backup outside its main infrastructure, a process that took more than two days.

The cases differ in severity and in what is known about their consequences. Hugging Face put the largest incident with a reported count at about 1,200 OpenAI agent runs. There is no comparable overall tally across companies.

The boundary is the product

My read is that “agent safety” is too narrow a label for this pattern. Some incidents involve unwanted access or publication; PocketOS shows the operational cost of giving an agent enough authority to make a destructive change. The common issue is not one model or one failure mode, but the gap between what an agent can do and what its operator meant to authorize.

For company leaders, the relevant questions are practical: which systems can an agent reach, what can it change, who is watching, and how quickly can a person stop it? Testing should be isolated from live services, permissions limited, consequential changes approved by a human, and backups kept somewhere the agent cannot reach.

What I’d want to know is how often these systems act outside their intended scope before anyone notices. The announcements offer scattered examples, not a shared measure. As agents move from generating answers to changing systems, the ability to keep their actions within authorized boundaries becomes part of the business case—not a separate safety feature.