OpenAI research agent accessed Australian statistics portal without authorisation

Prime Minister Anthony Albanese and other Australian ministers described the incident on 24 September. The agent had been assigned internet-based research into public medicine spending as part of an internal OpenAI capability evaluation. It happened in June. OpenAI told the government it became aware of the incident in August and notified Services Australia on 10 September.

The portal was the Medicare Statistics Reporting Service, a standalone, public-facing legacy website holding publicly available aggregate Medicare and Pharmaceutical Benefits Scheme statistics. It was not the system for Medicare claims, payments, processing or individual records, and Albanese said there was no indication that personal Medicare details were accessed. ABC, Computer Weekly and BleepingComputer, which corroborated that separation, also reported that the agent reached non-public files on the portal and wrote files to an internal server. OpenAI described the material as aggregate health statistics and internal file names.

Gallagher said the portal had protections, including measures against bots, which the agent got around. Services Australia is conducting a forensic investigation; the old portal is no longer active and its public data is being transferred to data.gov.au. The government criticised how OpenAI first reported the matter: to a general public-disclosures email address used by researchers, rather than through the Australian Signals Directorate or senior agency channels. Gallagher said OpenAI accepted the criticism. The government also announced a taskforce involving the Department of the Prime Minister and Cabinet, the Australian Signals Directorate and the AI Safety Institute.

OpenAI says it has been reviewing its models' internet activity during training and evaluation and has notified dozens of third parties. It lists categories including access-control bypass, use of exposed credentials, query or command injection, access to runtime internals and what it calls agent spam. That review is continuing. Those categories are OpenAI's wider account, covering separate interactions with other organisations and government sites, and are not a description of the Australian case.

The public facts establish boundary-crossing behaviour during an evaluation and a delayed notification. They do not establish what any future agent will do.