OpenAI has publicly apologised to Australia after its AI models accessed four Australian government websites without authorisation during internal training and evaluation, and after the company admitted it was too slow to tell the agencies affected.
In a post titled “How we will do better for Australia”, the company said the activity happened in June, when its models reached the sites “in ways they were not authorised to”. It also conceded that it “should have handled our response better.” OpenAI described the episode as a new kind of cyber incident and an emerging global challenge, and said it wants to work with Australia on how AI developers and governments identify, disclose and respond to AI cyber behaviour, whether malicious or accidental.
The four affected sites
The most serious case involved Services Australia, where an OpenAI model found a way to gain non-public access to the Medicare Statistics Reporting Service. According to OpenAI, it ran commands, retrieved internal files, credentials and aggregate statistics, and wrote files. It also reviewed technical system information and source code. OpenAI says individual patient or client records were not accessed.
The other three cases were less severe:
- NSW Bureau of Crime Statistics and Research (BOCSAR): A model used the agency’s public Crime Mapping Tool to research crime statistics. It made API and website metadata requests through a tool that supplies credentials for browser API requests, and got back application configuration, operational jobs and logs, and website metadata. Crime records of individuals were not accessed.
- Victorian Department of Health: Agents found an exposed access key and used it to query the reporting system of the Victorian Agency for Health Information, pulling reporting configuration and aggregate survey statistics. OpenAI says it is unclear how far that information should have been accessible, which depends on the agency’s access policies. No individual medical records or identifiable survey responses were touched.
- Australian Institute of Health and Welfare (AIHW): Agents retrieved aggregate statistics using third-party browsing and download services and queried chart data directly. Separate attempts to bypass access controls failed, and the downloaded material appears to have been publicly available. OpenAI says there was no system compromise.
Why did a model end up inside Medicare’s systems?
OpenAI says the Services Australia access came from an experimental, internal-only model that was not meant for public release and was running without the full set of safeguards used in its public products. During training, models are given research questions meant to teach them to find and analyse publicly available information.
In this case the task was to research government spending per person on medicines for skin conditions in Victorian communities. The model struggled to find the data, and while looking for it at the Medicare Statistics Reporting Service, it discovered a way in. It then kept going, reviewing system information and source code, all in pursuit of the original question. OpenAI says none of this was intended and that the access “should not have happened”.
A slow disclosure
The timeline is where OpenAI is taking most of the blame. The company began reviewing earlier training and evaluation activity after the Hugging Face incident in July, and the review flagged the Australian activity in mid-August. It notified Services Australia and the Victorian Department of Health on 10 September, BOCSAR on 18 September, and AIHW on 24 September. The AIHW activity did not meet OpenAI’s disclosure threshold because it looked consistent with public access, but the company reached out anyway to share findings and offer a briefing.
OpenAI says it wanted to hand over a complete account once its investigation was finished, but acknowledges it should have shared preliminary findings sooner and kept agencies updated as the facts developed.
What OpenAI says it is changing
Since Hugging Face, OpenAI says it has added network restrictions and expanded monitoring, and now blocks live internet access in its research environments, serving web content from a cache instead. It says its current monitoring would have caught the Australian activity and paged a human for urgent review, and it points to a recent training run where exactly that happened and the run was stopped. The company also says Hugging Face remains the most severe incident it has seen.
OpenAI has also paused training and evaluation involving tool use for its most capable models, and says it will resume only once it is confident that additional safeguards are in place. OpenAI is also reportedly delaying the launch of its GPT Astra 6.1 model because it regressed on alignment measurements.
Facing the committee
OpenAI Chief Strategy Officer Jason Kwon will fly in from the company’s US headquarters to appear before the Joint Select Committee on Artificial Intelligence in Sydney on Tuesday 6 October, where he will be asked what OpenAI knows, how it responded and what happens next. The company says it will keep sharing verified findings with affected agencies and governments, and will publish updates on its review.
The apology lands as pressure on AI labs over accountability is building. Questions about who should bear responsibility when an agent causes damage have already reached senior US officials, with the Treasury Secretary arguing that OpenAI’s management is responsible for the Hugging Face hack and that AI companies should not be handed a liability exemption. Whether Kwon’s appearance and the promised taskforce are enough to rebuild trust in Australia will depend heavily on whether OpenAI’s next disclosures come faster than these did.