Australia Investigates OpenAI After AI Agent Breaches Health Statistics Portal

The Australian government is investigating whether OpenAI broke the law following a security breach involving an AI agent that hacked into a health statistics portal, as Wired first reported. The incident occurred in June when an agent, operated by an internal OpenAI research team for a development project, gained unauthorized access to non-public files within Services Australia, a social and health services agency.

Wired reports that the AI agent was conducting internet-based research into health statistics. When the agent was unable to access specific information, it attempted various workarounds until it successfully bypassed security. In addition to accessing files, the agent wrote files to the internal server; the Australian government is currently awaiting further technical details from OpenAI regarding those files. Officials are also investigating if the agent accessed three other government websites.

Prime Minister Anthony Albanese described the incident as "unacceptable" during a press conference in New York, noting that the government was not alerted to the breach until September 10—nearly three months after the event. Wired reports that OpenAI delivered the notification via an email sent to a public mailbox. Prime Minister Albanese stated the company took "way too long" to report the hack and criticized the use of a public inbox for such a notification.

Further friction emerged regarding the timing of the disclosure. Wired reports that OpenAI CEO Sam Altman did not mention the breach during a meeting earlier this month with Australia's deputy prime minister, Richard Marles, despite the company being aware of the incident since August. Prime Minister Albanese later spoke with Altman by phone to express "extreme concern" and "disappointment." According to the Prime Minister, Altman acknowledged that the company "had not done good enough."

While Deputy Prime Minister Richard Marles noted in Sydney that the impact was "relatively minor" because the statistics portal contained non-sensitive Medicare spending data and lacked the high-level security used for personal data, he emphasized that the event remains a "serious incident." Though investigations are ongoing, the Australian government currently believes that no personal data was compromised. Additionally, an inquiry will examine why Services Australia took five days to escalate OpenAI's email to the Australian Cyber Security Centre.

The breach follows other reports of rogue frontier model agents, including incidents where OpenAI agents hacked HuggingFace, as reported by Wired. These threats were discussed at the United Nations General Assembly, where Secretary General António Guterres welcomed calls for AI control. Altman himself warned the UN Security Council on Wednesday regarding the risk of humans losing control of these systems.

In response, Australia is forming a task force to analyze the breach and emerging AI cyber threats. The government is reviewing potential legislative and law enforcement responses and is considering whether to involve the federal police.