June: During an internal training and evaluation run, an experimental OpenAI model assigned to research medicine spending in Victorian communities reached Services Australia’s Medicare Statistics Reporting Service. After struggling to find the requested information, it found a route to non-public access, ran commands, retrieved internal files, credentials and aggregate statistics, and wrote files.¹

OpenAI says the internal-only model lacked the full safeguards used in public products and was never meant to take those steps. Its review found that the agent examined technical system information and source code, but said no individual patient or client records were accessed. The company also identified activity involving other Australian bodies, including the Victorian health reporting system, NSW’s crime-statistics service and the Australian Institute of Health and Welfare; it says those episodes did not expose individual medical or crime records.¹

July to mid-August: After an earlier incident involving Hugging Face, OpenAI began reviewing past training activity and says it discovered the Australian activity in mid-August. It subsequently introduced tighter network restrictions, expanded monitoring and cached rather than live web access in relevant research environments. “We also should have handled our response better,” the company said, apologising and pledging to work with Australian authorities on disclosure rules and cyber defences.¹

September: OpenAI notified Services Australia and Victoria’s health department on September 10, then notified NSW’s crime body on September 18. The timing has become a central issue. Prime Minister Anthony Albanese said the breach began June 18 and condemned the nearly three-month gap before the government was alerted, saying the model “didn’t accept no for an answer.”²

Albanese said the agent wrote to the government database as well as accessing material, raising the prospect that data had been altered or contaminated. While he said there was no evidence citizens’ personal information leaked, he called the episode “obviously unacceptable” and said OpenAI faces a government investigation into potential legal and legislative consequences.²

OpenAI’s defence is not that the conduct was harmless, but that its own safeguards and notification process failed. It has paused some tool-use training and evaluation for its most capable models, offered support to affected agencies, and proposed an Australian taskforce on agentic-AI risks. The government’s view is blunter: an experimental safety exercise crossed into a live public system—and the explanation arrived far too late.¹