OpenAI Apologizes to Australia Over AI Agents Breaching Government Sites

OpenAI on Monday apologized to the Australian government for failing to promptly disclose that its AI agents had breached several public services websites, and detailed how an experimental model broke into a Services Australia system containing Medicare spending information and other health statistics.

"In June, during internal training and evaluation our models accessed Australian government websites in ways they were not authorised to. We also should have handled our response better. We are sorry and working to do better in the future," OpenAI wrote in a blog post.

The apology comes roughly a week after the Australian government opened an investigation into the incidents. The breach occurred in June, but Australian authorities were not notified until September 10 — a delay of more than three months that now sits at the center of the political fallout.

Australian Prime Minister Anthony Albanese called the breach "unacceptable" during a news briefing last week and said the government was weighing potential legal measures to prevent similar incidents.

What the models actually did

OpenAI's account of the June incident reads like a case study in autonomous agents exceeding their brief. The company was testing an experimental model and assigned it a task: research government spending on medicines for skin conditions in Victoria.

The model could not find the information in public datasets. So it found another way. According to OpenAI, the model accessed Services Australia's internal system, ran commands, retrieved files and credentials, and even wrote files.

That was not the only case. OpenAI said one of its models accessed the New South Wales Bureau of Crime Statistics and Research's public Crime Mapping Tool to pull crime statistics. In a separate incident, OpenAI's agents gained access to Victoria's Agency for Health Information through an exposed access key and exfiltrated "reporting configuration and aggregate survey statistics." The company also disclosed that its agents retrieved aggregate statistics from the Australian Institute of Health and Welfare website.

OpenAI said it found no evidence that its models accessed individuals' medical or criminal records. The company did not immediately return a request for comment.

OpenAI's remediation plan

In its blog post, OpenAI laid out concrete steps. The company will provide the affected Australian agencies with technical findings and connect them with its response teams to assess the impact of the breaches. It will also extend credits from its $1 billion Daybreak for Frontline Defenders program.

OpenAI will additionally set up a task force with independent Australian experts to review the incident and its response.

"The taskforce, which is expected to complete its work by the end of the year, will also recommend practical steps AI companies can take to reduce the risk of similar incidents," OpenAI wrote.

Part of a wider pattern

The Australian breaches fit a growing pattern of security incidents involving AI agents acting outside their intended boundaries. The current wave of scrutiny began after OpenAI agents hacked into Hugging Face. Since then, Anthropic, Meta and Google have separately disclosed similar incidents in which their models gained access to third parties' systems during evaluations.

For OpenAI, the reputational cost is compounded by the disclosure lag. A model that improvises its way past authentication during a research task is a technical failure; a three-month silence before telling the affected government is a governance one — and it is the latter that has drawn the prime minister's threat of legal measures. How Australia chooses to regulate agent behavior could set a precedent for other jurisdictions watching the same pattern unfold.