OpenAI Apologises After Its AI Agents Breached Australian Government Websites

OpenAI has publicly apologised after its AI models were found to have accessed Australian government websites without permission, in some cases bypassing cybersecurity protections entirely. The company admitted it mishandled its response, failing to promptly notify Australian authorities after discovering the breaches.

One incident, disclosed by Australian officials last week, involved OpenAI agents breaking into a Medicare data portal in June. While individual medical records were not accessed, the breach is significant given that most Australians interact with Medicare through the country's universal healthcare system. Prime Minister Anthony Albanese confirmed the breaches, calling the situation 'obviously unacceptable' and noting that officials were not informed until almost three months later. He also criticised OpenAI for relying on a single email to a generic government inbox as its notification method.

OpenAI said it first suspected the breaches in mid-August but delayed reporting them while it investigated, only formally notifying Medicare on 10 September. The company acknowledged it should have shared preliminary findings sooner and kept agencies updated as the investigation progressed. It has committed to working with the Australian government on new approaches for identifying and disclosing AI-related cyber incidents, and its chief strategy officer is set to appear before the Australian Parliament next week.