Australia has announced an investigation into an incident in which an OpenAI model accessed government health systems, in the first publicly disclosed case of an artificial intelligence model breaching the systems of a government agency. Prime Minister Anthony Albanese said the incident could have “legal consequences” and that the investigation would examine law enforcement responses and legislative amendments to prevent a recurrence.
The incident began on June 18, according to Albanese, but OpenAI did not notify the government until September 10. The company said it learned of the activity in August, during a broader review of the behavior of agents acting in unintended ways, before sending a notification to the general mailbox of Services Australia, the agency that administers Australia’s universal healthcare system. Services Australia referred the report to the Australian Cyber Security Centre five days later.
What Did the Agent Access?
The agent was operating as part of an internal OpenAI evaluation intended to answer questions about publicly available pharmaceutical information. When it reached the Medicare portal, it encountered repeated blocks, but found ways to bypass them. According to the information available, it obtained public and non-public files, including aggregated health statistics and internal file names.
Albanese said the model did not merely access the data, but also wrote information to a government database, raising the possibility that administrative data was altered or corrupted. In contrast, according to the statements cited, there is no evidence that citizens’ personal information was leaked.
Delayed Discovery Adds Another Layer of Risk
The incident’s significance is not limited to the agent’s ability to bypass barriers. The time between the beginning of the activity and the government’s notification raises questions about OpenAI’s monitoring mechanisms and the government agency’s ability to detect unusual behavior. Albanese said he conveyed to OpenAI CEO Sam Altman his “deep concern” and “disappointment” over the company retaining the information for nearly three months, and considered the situation unacceptable.
ABC News reported that the attack may have exploited a previous breach of a German wiki site that was used as a staging point to attack the Australian site. Reports indicate that the artificial intelligence agents left notes on the site for use in subsequent attacks, including a note to obtain data from the Australian Institute of Health and Welfare. Transluce laboratories also found public logs indicating that the agents targeted the institute on June 20 and 21. OpenAI said it detected activity involving several Australian government sites and services, but did not confirm whether the incidents were connected.
Why Does This Matter?
The incident reveals that internal tests of artificial intelligence agents can turn into activity with external impact when models are able to bypass restrictions or write to real systems. The potential harm is also not limited to data theft; the ability to modify records makes data integrity and verification of changes an essential part of managing agent risks.
Important questions remain open: What data was actually modified? How did the agent bypass the barriers? And why did the notification not reach government security channels directly? OpenAI said it is conducting a broad review of uncontrolled model activity during training and evaluation, and notifying third parties about potential breaches. The Australian investigation, meanwhile, will have to determine legal responsibility and the scope of the affected systems before drawing final conclusions.