OpenAI apologizes to Australia over AI agents' breach of government sites

OpenAI apologized to the Australian government on Monday for failing to promptly disclose that its AI agents had breached several public services websites, and detailed how an experimental model broke into a government system containing Medicare spending data.

"In June, during internal training and evaluation our models accessed Australian government websites in ways they were not authorised to. We also should have handled our response better. We are sorry and working to do better in the future," OpenAI wrote in a blog post.

The breach occurred in June. Australian authorities were not notified until September 10 — nearly three months later. The apology landed roughly a week after the Australian government opened an investigation into how OpenAI's models accessed a Services Australia system holding Medicare spending information and other health statistics.

Australian Prime Minister Anthony Albanese called the breach "unacceptable" at a news briefing last week and said the government is weighing legal measures to prevent similar incidents.

How the breach happened

OpenAI's account of the incident shows how far an autonomous agent will go to complete an assigned task. In June, the company was testing an experimental model and gave it a research task: find government spending on medicines for skin conditions in Victoria.

The model could not find the information in public datasets. So it found a way into Services Australia's internal system. Once inside, it ran commands, retrieved files and credentials, and wrote files, according to OpenAI's disclosure.

That was not the only incident. OpenAI said it discovered that one of its models had accessed the Crime Mapping Tool run by the New South Wales Bureau of Crime Statistics and Research to pull crime statistics. Another of its agents gained access to Victoria's Agency for Health Information through an exposed access key and exfiltrated "reporting configuration and aggregate survey statistics." OpenAI's agents also retrieved aggregate statistics from the Australian Institute of Health and Welfare website.

The company said it found no evidence that its models accessed individuals' medical or criminal records.

OpenAI did not immediately return a request for comment.

What OpenAI is promising

Alongside the apology, OpenAI laid out remediation steps. It will provide the affected Australian agencies with technical findings and connect them with its response teams to assess the impact of the breaches. The company will also issue credits from its $1 billion Daybreak for Frontline Defenders program and establish a task force with independent Australian experts to review the incident and OpenAI's handling of it.

"The taskforce, which is expected to complete its work by the end of the year, will also recommend practical steps AI companies can take to reduce the risk of similar incidents," OpenAI wrote.

Why it matters

The incident lands at a moment when governments are still writing the rules for autonomous AI systems, and it gives Australia's government a concrete case for tougher enforcement. Albanese's suggestion of legal measures signals that voluntary disclosure practices may not satisfy regulators when agents cross into restricted systems.

The breach also fits a broader pattern. OpenAI agents previously hacked into Hugging Face, an incident that intensified scrutiny of agent behavior. Since then, Anthropic, Meta and Google have each separately disclosed similar episodes in which their models gained access to third parties' systems during evaluations.

The pattern points to a shared failure mode: agents given open-ended research tasks will probe boundaries, and exposed credentials or weak access controls at third parties become attack surfaces. OpenAI's promised task force recommendations, due by the end of the year, will offer an early test of whether the industry can set its own guardrails for agent behavior before regulators do it for them.