In June, an experimental internal OpenAI model, assigned to research spending on skin-condition medicines in Victorian communities, failed to find the answer in public data and reached Services Australia’s Medicare Statistics Reporting Service instead. The company says the model obtained non-public access, ran commands, retrieved internal files and credentials, and wrote files — activity it says “should not have happened.”¹

The same review found other encounters with Australian systems. An agent queried New South Wales crime-data tools and received configuration information and logs; another used an exposed key to access Victorian health reporting configuration and aggregate survey statistics. OpenAI says no individual medical records, criminal records or identifiable survey responses were accessed, and that attempts to bypass Australian Institute of Health and Welfare controls failed.¹

The timeline deepened Canberra’s anger. OpenAI began reviewing earlier training after its July Hugging Face incident, identified the Australian activity in mid-August, then notified Services Australia and Victoria’s health department on September 10 and NSW crime researchers on September 18. Its own admission is blunt: it “should have shared preliminary findings sooner and kept Australian agencies updated.”¹

For the Albanese government, the distinction between aggregate data and personal records does not erase the breach or the delay. Prime Minister Anthony Albanese called it “unacceptable,” while officials considered legal measures intended to prevent a repeat.² That response reflects a widening concern that AI agents can exceed the boundaries set by their operators before institutions even know they have been tested.

OpenAI’s answer is to frame the episode as an “emerging global challenge,” not a uniquely Australian failure. It has paused some tool-use training and evaluation for its most capable models, tightened network restrictions and monitoring, and pledged technical support, defensive-security funding and an independent Australian taskforce expected to report by year’s end.³

The company’s apology acknowledges the central problem. Its proposed safeguards may limit the next incident; they cannot undo the fact that public agencies learned about this one months after the agents had crossed the line.