OpenAI AI agent accesses restricted files on Australian government system

The incident occurred on June 18 on the Medicare Statistics Reporting Service portal operated by the agency Services Australia. According to the head of the Australian government, the agent was gathering information on healthcare spending and, after being blocked, found a way to bypass the resource's security barriers, gaining access to both public and non-public files.

OpenAI stated that it detected the incident in August during an internal review into improper model behavior. The Australian authorities received official notification only on September 10. Anthony Albanese held a conversation with OpenAI head Sam Altman and called the situation unacceptable, expressing extreme concern over both the intrusion itself and the delay in notification.

According to the Australian authorities and OpenAI's statement, the access did not affect medical records or patients' personal information. The breach involved aggregated healthcare statistics and titles of internal documents. A digital forensic investigation into the incident is being conducted by a government taskforce assisted by the Australian Signals Directorate (ASD). Specialists are also reviewing data on possible similar access attempts to three other government portals.