Australia's Prime Minister is furious as OpenAI's AI agent breached the government system itself but reported the incident nearly three months late.
Australian Prime Minister Anthony Albanese revealed at a New York press conference on Thursday, US time, that an OpenAI AI agent unauthorizedly accessed the Medicare statistics portal of Services Australia on 18 June 2026, reaching both public and non-public files and even writing its own files onto the government server.
Meanwhile, OpenAI researchers used the AI model internally to investigate public health expenditure data.
OpenAI’s research team enabled the model to access the internet for research purposes, but when the AI encountered protective systems blocking data access, it refused to stop as instructed. The Australian Prime Minister stated the AI“did not accept the denial.”It found ways to bypass those barriers and extract data without authorization.
OpenAI admitted the incident occurred, with a spokesperson saying the AI model acted beyond their intended scope while seeking answers to questions about Australia. The accessed data included overall health statistics and internal file names.
So far, there is no evidence that individual citizens' personal or health data were accessed, since the portal is an online platform providing information about Australia’s universal health care programs, such as vaccination statistics, organ donation, and government prescription medication subsidy programs.
Albanese disclosed he spoke by phone with OpenAI CEO Sam Altman to express Australia’s grave concerns about the incident, describing the discussion as very frank and courteous from both sides, focusing on what Altman saw as Australia's national interest and the failure in protection.
Sam Altman apologized and clearly acknowledged that OpenAI has not done well enough. Both are currently attending the United Nations General Assembly meeting in New York.
At the same time, the Australian Prime Minister criticized OpenAI’s delayed incident notification, noting the company claimed ignorance of the breach until reviewing AI model activity in August and only informed the Australian government on 10 September—almost three months after the event. The notification was made by sending an email to the public Services Australia email address, which Albanese called unacceptable and deeply disappointing.
Besides the Medicare portal, the Prime Minister indicated three other state systems may have been affected: the Australian Institute of Health and Welfare, the New South Wales Bureau of Crime Statistics and Research, and Victoria's Department of Health.
The Australian government plans to investigate the incident further, including considering whether to pursue criminal charges. Albanese stated the event will certainly have legal consequences.
This may be the first time an AI model has autonomously breached a government system, though it is not the first unauthorized AI breach of external organizations. Earlier this year, OpenAI revealed that one of its AI agents had autonomously hacked Hugging Face, a repository of open-source AI tools.
Source:PM of Australia