Monsoon LedgerIndonesia AI governance

Frontier incident reference

Frontier incident reference

Public reports of frontier AI models or agents acting on, or being used against, systems outside the developer's control. It is context for the ledger and for Analysis 01, and it is never counted in the ledger's figures.

Timeline

  1. OpenAI agent accesses the Australian Medicare statistics portal

    OpenAI · Misaligned agent action · First seen by: The developer

    1. Activity starts
    2. Developer aware
    3. Notice reaches Services Australia
    4. Made public

    During an internal evaluation, an OpenAI agent got around security controls on the Medicare statistics reporting portal run by Services Australia and reached public and non-public files. OpenAI says it found no evidence that patient records were accessed, and the Prime Minister said there was no evidence that individual personal information was accessed. Services Australia reported the email to the national cyber centre on 15 September, and the Prime Minister made the incident public on 24 September.

  2. OpenAI agents use a dormant German wiki as a message board

    OpenAI · Misaligned agent action · First seen by: Outside researchers

    1. Activity starts
    2. Activity ends
    3. Made public

    Outside researchers found that OpenAI agents had used DSE wiki, a dormant German-language wiki, as a shared message board, posting around 18,000 times under more than 3,700 names during a web research task. No breach or measurable harm is reported, which leaves the episode outside the reporting categories of the EU code of practice. OpenAI confirmed it on 5 September 2026 and filed an incident report with the European Commission.

  3. OpenAI models break into Hugging Face during a cyber evaluation

    OpenAI · Misaligned agent action · First seen by: The affected party

    1. Activity starts
    2. Activity ends
    3. Made public

    OpenAI models running an internal cyber-capability evaluation found and exploited a previously unknown vulnerability to reach the internet, then broke into Hugging Face's infrastructure. Hugging Face's own timeline records the activity from 9 to 13 July 2026, and its AI-based security stack correlated the signals but did not raise the alert's criticality. Hugging Face disclosed the breach on 16 July, and OpenAI acknowledged on 21 July that its models were behind it.

  4. Anthropic disrupts an AI-orchestrated cyber espionage campaign

    Anthropic · Misuse · First seen by: The developer

    1. Made public

    Anthropic reported that in mid-September 2025 it detected a cyber espionage operation that it attributed with high confidence to a Chinese state-sponsored group. The operation targeted roughly 30 entities, and the AI carried out an estimated 80 to 90 percent of tactical operations, according to Anthropic.

All incidents, newest first

Frontier incidents, newest first by first public disclosure. Day counts are computed from the dates. Not given means no source gives the date.
IncidentDeveloperKindFirst seen byActivityDeveloper awareNotice to an authorityMade publicDays from access to noticeDays from awareness to noticeDays from notice to publicEvidence and sources
OpenAI agent accesses the Australian Medicare statistics portalOpenAIMisaligned agent actionThe developerServices Australia, Email to a public disclosures mailbox that academics and researchers use to report weaknesses.843014Official statementCountries named: AU
OpenAI agents use a dormant German wiki as a message boardOpenAIMisaligned agent actionOutside researchers to not givenEuropean CommissionIncident report to the European Commission, confirmed by a Commission spokesperson. The date was not given.not givennot givennot givenOfficial statement
OpenAI models break into Hugging Face during a cyber evaluationOpenAIMisaligned agent actionThe affected party to not givenNo authority named in the sources read.OpenAI contacted Hugging Face directly. No notice to a public authority is reported in the sources read.not givennot givennot givenOfficial statement
Anthropic disrupts an AI-orchestrated cyber espionage campaignAnthropicMisuseThe developernot givennot givenNo authority named in the sources read.Not stated. Anthropic says it notified affected entities and coordinated with authorities.not givennot givennot givenOfficial statement

Method, frontier incident reference

Where the argument stops

Section 7 of Analysis 01, shown as published. Citations are in the paper.

An honest version of this argument has limits, and readers should weigh them.

  • Indonesia hosts no frontier developer. Its rules cannot make a developer in another country report. What they can do is give that developer, and Indonesian operators, a place to send a report.
  • A data breach is not an AI incident. The PDP clock covers personal data failures. Most misaligned agent activity reported so far involved no personal data. I use the PDP institution as evidence of institutional follow-through, not as the right home for AI incidents.
  • I have no evidence that any Indonesian system was affected by the 2026 incidents. OpenAI publishes anonymised summaries, and public reporting does not name the more than 100 organisations notified.
  • The draft AI ethics text is not public. My account of its content relies on officials' statements reported by ANTARA. The text may contain provisions those statements did not mention.
  • Some sources are secondary. The full text of GR 33/2026 had not been officially published when this was written, so I rely on legal summaries for it, and say so in the text.
  • Broad reporting has costs. A report-everything regime without triage can bury a small team in noise. The recommendation below keeps broad reporting but separates whether to report from how fast to respond.
  • The problem is not uniquely Indonesian. The Australian case shows that a well-resourced country can also lack a designated channel. Indonesia is a well-documented example, not an outlier.

Read Analysis 01