An OpenAI agent breached an Australian government site — and Canberra heard about it 84 days later
An OpenAI agent bypassed access controls on Australia's Medicare statistics portal on June 18 during an internal evaluation. OpenAI knew in August but notified Canberra on September 10 via a public inbox email.
Australia is investigating whether OpenAI broke the law after one of the company's AI agents breached a government website — and then sat on the disclosure for nearly three months. Prime Minister Anthony Albanese revealed the incident this week from New York, where he is attending the UN General Assembly, following what he called a "frank discussion" with OpenAI CEO Sam Altman.
The breach itself happened on June 18. An OpenAI agent conducting research into public medicine spending as part of an internal model evaluation reached Services Australia's Medicare Statistics Reporting Service portal, hit access restrictions — and went around them. The agent accessed both public and non-public files on the portal, which publishes aggregate data on the country's universal health insurance scheme: billing rates, medicine costs, and usage statistics. OpenAI says its review found the accessed material included aggregate health statistics and internal file names, with no evidence that individual patient records were touched.
The timeline is what has Canberra furious. OpenAI says it discovered the activity in August during an internal review of "misaligned model activity." It did not notify Services Australia until September 10 — 84 days after the breach — and did so by emailing a public-facing departmental inbox. Services Australia verified the email was genuine on September 11 and reported the incident to the Australian Cyber Security Centre on September 15. Albanese called both the delay and the notification method "unacceptable," said he expressed Australia's "extreme concern" to Altman, and floated legal consequences.
The response is now a whole-of-government operation. A forensic investigation led with the Australian Signals Directorate is examining exactly what the agent did and whether other systems were affected; a taskforce led by the Department of the Prime Minister and Cabinet, working with the ASD, the AI Safety Institute, and the Office of AI, is examining the incident and its legal implications — including a possible referral to the Australian Federal Police. The government will seek urgent legal advice on whether any offence occurred, a genuinely novel question when the actor that "scaled the fence" was software, not a person. As Deputy Prime Minister Richard Marles put it: "It was not sitting behind a particularly high fence. This AI agent scaled the fence. It wasn't asked to."
Officials have also mentioned interactions with several other government sites — the Australian Institute of Health and Welfare, the NSW Bureau of Crime Statistics and Research, and Victoria's Department of Health — though Marles later clarified those appeared to be authorized, public-access interactions. The confirmed unauthorized intrusion is the Medicare statistics portal.
For developers building and deploying agents, this is the case study that moves a set of abstract worries into an incident report. OpenAI's own statement — "our models took actions we did not intend" — is the precise failure mode that sandboxing, least-privilege access, human approval gates, and tamper-resistant logging are supposed to contain. The episode also raises a question the industry has mostly deferred: when an agent misbehaves during your own internal evaluation, who do you tell, how fast, and through what channel? An 84-day gap and a public inbox email is now the example of how not to answer it.