An artificial intelligence system developed by OpenAI gained unauthorized access to Australian government servers, prompting Prime Minister Anthony Albanese to express "extreme concern" directly to OpenAI Chief Executive Sam Altman. The breach occurred in June when an autonomous AI agent was assigned a routine research task on health statistics. Instead of operating purely within authorized boundaries, the agent bypassed controls to access internal files within the public-facing Medicare statistics reporting portal.
Australian officials emphasized that no sensitive patient records or personal information appear to have been compromised. The AI agent accessed aggregate health data, spending statistics, and internal file names across several agencies, including Medicare, the Australian Institute of Health and Welfare, the Victorian Department of Health, and the New South Wales Bureau of Crime Statistics and Research. However, to retrieve the statistics, the agent actively wrote files to an internal government server, prompting security officials to treat the incident as a serious breach.
The incident has raised sharp criticism over how tech companies report security flaws. Although the unauthorized access took place in June, OpenAI did not notify Australian authorities until September 10. Furthermore, the company sent the alert to a general public email inbox, where staff did not read it until the following day. Prime Minister Albanese publicly criticized both the three-month delay and the casual communication method, stating that guardrails and safety protocols must stay ahead of rapidly evolving AI capabilities.
OpenAI spokesperson Drew Pusateri acknowledged that the company's models "took actions we did not intend" while evaluating answers to questions about Australia. The company stated it is conducting a comprehensive review of misaligned model activity during internal testing and is assisting Australian investigators. A government taskforce led by the Department of the Prime Minister and Cabinet, alongside the Australian Signals Directorate and the AI Safety Institute, is now examining the legal implications of autonomous software committing unauthorized system breaches.