Australia has launched an investigation after an OpenAI agent gained unauthorized access to a government statistics website, prompting Prime Minister Anthony Albanese to raise concerns directly with the company’s chief executive, Sam Altman. The breach occurred on June 18, 2026, and was publicly disclosed on September 24, Australian time.
The agent accessed public and nonpublic files within the Medicare Statistics Reporting Service portal, administered by Services Australia. Albanese said the evidence available so far did not indicate that personal information had been accessed or that the agency’s broader network had been compromised. A forensic investigation remains underway.
Research task led to unauthorized access
According to Albanese, OpenAI’s research team was using an internal model to investigate public medicine spending when the agent encountered access restrictions. Rather than stopping, it attempted alternative ways to obtain information and entered restricted areas of the portal.
Government Services Minister Katy Gallagher emphasized that the affected website was separate from systems handling individual Medicare claims, payments and personal information. Researchers and academics use the portal’s aggregated figures to study prescribing and benefit spending.
In a statement reported by ABC, OpenAI said it identified the activity during a review of unintended model behavior involving Australian government websites during an internal evaluation.
“In the course of that, our models took actions we did not intend,” a company spokesperson said.
OpenAI said its review found no evidence of patient records being accessed. The information involved included aggregate health statistics and internal file names. The company said it was providing technical information to support investigations and help address potential security vulnerabilities.
Notification delay draws criticism
Albanese criticized both the delay in reporting the incident and the decision to notify Services Australia through a public email inbox. He said he raised those concerns with Altman.
Acting Prime Minister Richard Marles said OpenAI had advised the government that it discovered the incident in August. Services Australia received notification on September 10—nearly three months after the unauthorized access occurred, rather than three months after the company said it became aware of it.
Gallagher said the email went to an address used by researchers and others to report potential vulnerabilities. Services Australia notified the Australian Signals Directorate on September 15 after checking the information.
Review to examine safeguards and government response
The government’s task force will examine the incident, the security of government networks and whether existing legal arrangements adequately address emerging AI cyber threats. Marles said investigators would also consider whether any laws had been broken; no such conclusion has been established.
Marles separately clarified that the model’s interactions with three other government websites involved authorized access to public information, not additional confirmed breaches. He described the impact of the statistics-portal incident as relatively minor but said the unauthorized access remained a serious concern.
The complete extent of the access remains under investigation. In a radio interview, Marles said officials were still establishing the volume of data involved and working with OpenAI to understand what happened.
Gallagher said the affected statistics portal was no longer active. Its public data is being transferred to another government platform, and the old website will not be reactivated.
See all the latest news from Greece and the world at Greekreporter.com. Contact our newsroom to report an update or send your story, photos and videos. Follow GR on Google News and subscribe here to our daily email!
