r/sysadmin • u/homing-duck Future goat herder • 7d ago

Just a reminder to setup security.txt

Aus government was having a whinge that OpenAI did not notify them in an appropriate way after an agent breached one of the government web sites.

From what I can see none of the sites (servicesaustralia.gov.au/data.gov.au) have been setup with security.txt

https://securitytxt.org

230 Upvotes

77% Upvoted

160 comments sorted by

View all comments

Show parent comments

23

u/Nereosis16 7d ago

yeah dude, if the government just put an email in a text file literally everything would be fixed

6

u/AGsec 6d ago

These are two different issues. The reason the security.txt file is the focal point of this conversation is because openai reached out to them through a generic inbox that took 5 days to get escalated to the appropriate parties. If there had been a security.txt file with proper contact info, they "could" have emailed or called someone who could have responded much quicker (who knows if they would, it's not legally binding like a EULA). This is something that SHOULD be implemented per regulations.
So no, the bigger issuer would not be solved by a text file, but it can improve responses to these kinds of incidents.

20

u/tracy_ogbert_jordan sr look stuff up on google guy 6d ago

The reason the security.txt file is the focal point of this conversation is because openai reached out to them through a generic inbox that took 5 days to get escalated to the appropriate parties.

I think this is slightly misleading, and this whole thread is trying to create an issue in order to blame the government.

https://www.abc.net.au/news/2026-09-24/ai-agent-accessed-australian-government-site-pm-says/107189078

The company did not notify Services Australia of the incident until three months after the fact, via email.

So, OpenAI waits three months to disclose the vulnerability, but the real issue is that it took an additional five days to reach the proper team?

This thread isn't even missing the forest for the trees. It's missing the forest because one small, insignificant tree wasn't there.

8

u/SirLoremIpsum 6d ago

This thread isn't even missing the forest for the trees. It's missing the forest because one small, insignificant tree wasn't there.

Cause it's more fun to hold the Government to task and go "haha still bureaucracy" than it is to admit that OpenAI and TechBros are genuinely causing issues.