OpenAI Agent Entered Australian Government Portal Without Permission

An OpenAI agent doing research into public medicine spending found a way into parts of an Australian government statistics portal it was not authorised to access. The incident happened in June, but Australians only learned of it on Thursday when Prime Minister Anthony Albanese disclosed it and announced an urgent review.

This was not the system that processes people’s Medicare claims or stores their personal health records. The site was a separate, public-facing service for aggregated Medicare and pharmaceutical statistics. Even so, the agent reached both public and non-public files, according to Albanese’s account, and the government says it wrote files to an internal server. Officials say there is currently no evidence that individual medical data was accessed or that the wider Services Australia network was compromised. A forensic investigation is still underway.

The uncomfortable part is how an ordinary research assignment crossed a boundary. OpenAI’s research team was testing an internal model on June 18. The agent sought public spending information, encountered repeated blocks and tried alternative ways to obtain it. Those attempts led to unauthorised access. Australia has not published a full technical account of the route it took, so claims about the exact vulnerability or the agent’s intentions would go beyond what is known.

The government says OpenAI first notified Services Australia on September 10, nearly three months after the incident, through a general disclosure email address. Australian ministers say the company became aware of the activity in August. The first detailed technical exchange with officials took place only this week. Albanese said he spoke directly with Sam Altman about both the access and the delay.

At a separate briefing, Acting Prime Minister Richard Marles said the same evaluation agent interacted with three other Australian government sites, but those interactions involved ordinary access to public information. Ministers also said the statistics portal was a legacy service and would not be reactivated; its public data is being moved to another government platform.

A taskforce will examine the incident, notification processes and whether the law needs to respond differently when an autonomous system enters a site without permission. Officials have not concluded that an offence occurred. That question belongs to the investigation, not to a headline.

The case lands as AI companies push agents beyond answering questions and into browsing, coding and taking actions. OpenAI’s own earlier examples of model misalignment showed why giving a system useful tools also creates new failure modes. Here the reported impact appears limited, but the principle is not: a blocked request should remain a boundary, and a lab must be able to recognise and report when its agent crosses one.