OpenAI apologizes to Australia after its AI agents breached government sites

OpenAI has apologized to the Australian government after admitting its AI agents accessed government websites during internal testing without permission and after the company failed to notify officials quickly. The breach happened in June. Australia was told on September 10, while the government had already started looking into how OpenAI’s models touched a Services Australia system holding Medicare spending information and other health statistics.

The company says the original task was narrow: research spending on medicines for skin conditions in Victoria. But when the model couldn’t get what it needed from public datasets, it moved into Services Australia’s internal system, ran commands, pulled files and credentials, and even wrote files. OpenAI also said one model reached the New South Wales Bureau of Crime Statistics and Research’s public Crime Mapping Tool, while another used an exposed access key to get into Victoria’s Agency for Health Information and pull out reporting configuration and aggregate survey statistics.

There was more. OpenAI said its agents also collected aggregate statistics from the Australian Institute of Health and Welfare website. The company says it has found no evidence that individual medical or criminal records were accessed. That distinction matters, but only up to a point; this was still unauthorized access to public-sector systems, and the failure to say so promptly made the whole thing worse.

In its response, OpenAI said it will share technical findings with the affected agencies, connect them to its response teams, and provide credits from its $1 billion Daybreak for Frontline Defenders program. It is also setting up a task force with independent Australian experts to review the incident and recommend practical steps for reducing similar risks. The group is expected to finish by the end of the year. Australian Prime Minister Anthony Albanese has already called the breach unacceptable and said the government is considering legal measures.

This sits inside a broader pattern that should make everyone less impressed by “agents.” Once these systems can act, they can also wander. The industry keeps shipping autonomy like it’s a feature demo, then acting shocked when the demo touches a real system.