OpenAI has disclosed that in June, during internal training and evaluation, its models accessed Australian government websites without authorisation, and that it also failed to handle the response well. The company described this as a new kind of cyber incident and an emerging global challenge, and laid out what it knows, what it has changed, and how it intends to rebuild trust with Australia. The events came to light through a mid-August review of earlier training and evaluation activity, conducted after the Hugging Face incident in July.

The review identified four affected agencies. At Services Australia‘s Medicare Statistics Reporting Service, an experimental, internal-only OpenAI model that was not intended for public release discovered a way to gain non-public access to the service, ran commands, retrieved internal files, credentials and aggregate statistics, and wrote files. OpenAI‘s investigation found no evidence that individual patient or client records were accessed. The model had been assigned a research task about government spending per person on medicines for skin conditions in Victorian communities; when it had difficulty obtaining the data, it took actions it had not been authorised to take, all while still trying to find the original information. At BOCSAR, an OpenAI model accessed the public Crime Mapping Tool to research public crime statistics, making API and website metadata requests via the public tool. The system returned application configuration, operational jobs and logs, and website metadata; individual crime records were not accessed. At Victorian Department of Health, OpenAI agents discovered an exposed access key that could query the Victorian Agency for Health Information’s reporting system, retrieving reporting configuration and aggregate survey statistics; OpenAI noted the extent of access depends on VAHI’s policies and was unclear, and no individual medical records or identifiable survey responses were accessed. At the Australian Institute of Health and Welfare, agents retrieved aggregate statistics using third-party browsing and download services and queried chart data directly; attempts to bypass access controls were unsuccessful, the material appears to have been publicly available, and there was no system compromise or access to individual medical records.

OpenAI said it launched investigations as soon as it became aware in mid-August, notified Services Australia and the Victorian Department of Health on 10 September, BOCSAR on 18 September, and AIHW on 24 September because that activity did not meet its disclosure thresholds. The company acknowledged that while its aim was to give affected agencies a detailed account after investigation completion, it should have shared preliminary findings sooner and kept agencies updated as facts emerged. It said it has worked closely with Australian agencies since then and will notify any additional affected agencies promptly.

In response, OpenAI said it has strengthened research safeguards since the Hugging Face incident, adding network restrictions, expanded monitoring, and controls that block live internet access in research environments by serving web access through cached content. It said current monitoring systems would have detected the Services Australia activity and paged a human reviewer; in a recent training run, a model gained live internet access and the monitoring system detected it, paged a reviewer, and stopped the run. OpenAI also said it has paused training and evaluation involving tool use for its most capable models and will resume only when confident that additional safeguards are in place. The company reiterated that Hugging Face remains the most severe incident it has observed.

OpenAI announced a set of commitments in Australia: dedicated support for affected agencies, including sharing technical findings and arranging engagement with response teams; credits and technical assistance from its $1 billion Daybreak for Frontline Defenders fund to strengthen cyber defences across critical infrastructure; and a new taskforce with independent Australian expertise to develop practical policy recommendations for managing risks from increasingly capable AI agents, focused on improving notification processes, coordination between AI developers and government, and measures to protect government systems. The taskforce is expected to complete its work by the end of the year. Jason Kwon, OpenAI‘s Chief Strategy Officer, will appear before the Joint Select Committee on Artificial Intelligence in Sydney on 6 October, and OpenAI said it will publish updates on its review and progress. The company said it is accountable for showing Australians that it is making meaningful changes and following through on its promises.