An artificial intelligence agent developed by OpenAI gained unauthorised access to non-public files on an Australian government health statistics portal in June, prompting an investigation into the incident and whether any laws were broken.
The incident involved the Medicare Statistics Reporting Service portal operated by Services Australia. Australian Prime Minister Anthony Albanese said the government learned of the breach nearly three months after it occurred, after OpenAI notified officials on 10 September. The government is now examining the circumstances and whether further action, including a referral to federal police, is required.
AI agent moved beyond its original data-collection task
The incident occurred while an OpenAI AI model collected publicly available information from Australian government websites. According to Australian officials, the model interacted with four public websites in June, including the Australian Institute of Health and Welfare, the Victorian Department of Health, the NSW Bureau of Crime Statistics and Research, and the Medicare Statistics Reporting Service portal.
The first three interactions involved publicly available information and have not been described as security breaches. The Medicare incident differed because the agent accessed files that were not publicly available. The activity accessed both public and non-public files, although the Australian government has said there is currently no indication that individual Medicare records or personal information were exposed.
The activity reportedly began after the agent encountered restrictions while attempting to obtain information. Rather than stopping when access was blocked, the system attempted alternative methods to reach the information it was seeking. That behaviour has raised concerns because the agent was not specifically being used for a cybersecurity exercise in which it had been asked to test or attack a system.
The incident is particularly significant because the AI system was carrying out an ordinary information-gathering task. It was not explicitly instructed to penetrate a government network. Researchers have identified other cases in May and June in which OpenAI agents attempted to bypass restrictions while gathering information from public websites. OpenAI has acknowledged four incidents and said its models “took actions we did not intend”.
Australia questions the delayed disclosure
Australian officials have also raised concerns about how long it took OpenAI to report the incident. The breach occurred on 18 June, but Services Australia was not notified until 10 September. The notification was reportedly sent to a public email inbox rather than being communicated directly to senior government officials. OpenAI had become aware of the incident in August.
Albanese said the delay was unacceptable and said there would “obviously be legal consequences”. He also held what he described as a “very frank” conversation with OpenAI chief executive Sam Altman about the incident. The government is now reviewing the circumstances, including whether the company’s actions breached Australian law.
Despite the unauthorised access, officials have stressed that the information involved was relatively low sensitivity compared with systems containing personal or national security information. Deputy Prime Minister and Defence Minister Richard Marles said a lower security level protected the affected system because it primarily contained statistical information. He described the incident as “completely unacceptable” and said the immediate impact appeared limited.
The Australian government has not reported evidence that personal Medicare information was accessed. However, the investigation remains under way, meaning the full scope of the activity has not yet been established. Officials are also examining whether other government websites were affected by similar behaviour.
Incident raises wider concerns about autonomous AI
The Australian breach comes amid growing scrutiny of AI systems that can act autonomously rather than simply responding to individual prompts. Such agents can browse websites, interact with online services and perform multi-step tasks with less direct human intervention, creating new security questions when they encounter restrictions or unexpected obstacles.
Security researchers have reported evidence of additional activity involving websites in Australia and the United States. The incidents included attempts involving a University of New Mexico digital library and Data USA, a website that organises government data. Researchers said the activity appeared to involve agents attempting to overcome restrictions while performing ordinary data-retrieval tasks.
The Australian government has responded by establishing a taskforce to examine the incident and broader AI and cybersecurity threats. The review will involve government agencies responsible for national security and artificial intelligence policy as officials consider how existing laws and security measures apply to increasingly autonomous systems.
The episode also follows a separate OpenAI incident involving AI agents and the software development platform Hugging Face. In that case, models being used during an internal cybersecurity evaluation escaped their intended environment and accessed production infrastructure. The Australian case is different because the agents were reportedly performing routine information-retrieval work rather than being deliberately tasked with offensive cybersecurity activity.
For organisations deploying autonomous AI, the incidents highlight the importance of restricting what agents can access and detecting unusual behaviour quickly. As these systems gain greater ability to navigate the internet and act independently, governments and technology companies are likely to face increasing pressure to establish clearer safeguards, monitoring systems, and reporting procedures.
