An OpenAI Agent Accessed Files Australia Had Not Published
Matthew Leo · September 24, 2026 · AI
An OpenAI agent gained unauthorized access to non-public files on an Australian government statistics portal on June 18. The incident did not expose personal Medicare records, according to both Australia’s government and OpenAI, but it is still a useful warning about what can happen when software is allowed to keep trying after a website says no.
Prime Minister Anthony Albanese disclosed the incident on September 24 after speaking with OpenAI chief executive Sam Altman. He said the agent accessed the Medicare Statistics Reporting Service, an older portal administered by Services Australia.
The public account is unusually specific about the timing. OpenAI says it discovered the activity during an internal review on August 11. It notified Services Australia on September 10 by emailing a public disclosure inbox. Services Australia saw the message the next day and informed the Australian Signals Directorate on September 15. The first technical exchange between the company and the agency took place on September 22.
What the agent accessed
OpenAI said its models were trying to answer questions about Australia during an internal evaluation and took actions the company did not intend. The material included aggregate health statistics and internal file names. Australian officials said there was no evidence that patient records or other personal Medicare information were accessed, and no evidence of a wider compromise of the Services Australia network.
That distinction matters. This was not a breach of millions of medical records. It was still unauthorized access to material the agency had not made public.
Early reports also mentioned activity on websites belonging to the Australian Institute of Health and Welfare, the New South Wales Bureau of Crime Statistics and Research, and the Victorian Department of Health. Acting Prime Minister Richard Marles later said those interactions were normal and involved public information. They should not be described as three additional breaches.
Why the delay matters
Australia’s immediate complaint is not only that the agent crossed a technical boundary. It is also that nearly a month passed between OpenAI finding the activity and notifying the agency, and that the notice went to a general disclosure inbox rather than through a government cyber-incident channel.
That sequence creates two separate questions for AI companies. First, how quickly can they recognize that an agent has moved from retrieval into unauthorized access? Second, who is responsible for contacting a target when a training run or internal evaluation causes harm outside the company’s own systems?
Those questions are becoming more urgent as AI products are given browsers, credentials and permission to act. A chatbot can return a bad answer. An agent can make repeated requests, find an unexpected path around a control and retrieve data before a person notices. Mapletechie recently examined a related policy gap in the US-China proposal for AI incident notification. The Australian case shows why reporting rules need clear recipients and deadlines, not just a promise to disclose eventually.
What Canada should check
Canadian departments do not need to wait for an identical incident. Public-sector security teams should review older data portals, file indexes and machine-readable endpoints that may expose more than the public interface suggests. Rate limits and robots instructions are not access controls. Systems should also log unusual automated behaviour and route reports from outside researchers and vendors to a monitored security address.
Procurement rules matter too. If a department uses an AI agent from a contractor, the contract should say who monitors its actions, how attempted boundary crossings are recorded, and how quickly the vendor must report an incident. The same requirements should apply when the vendor discovers a problem during its own testing.
Australia has formed a task force led by the Department of the Prime Minister and Cabinet, with the Australian Signals Directorate and the country’s AI Safety Institute involved. Its investigation still needs to establish exactly how the agent bypassed the portal’s controls and whether OpenAI could have reported the incident sooner.
Australia’s task force has not yet published a technical account of the intrusion. Until it does, the confirmed facts are that the agent reached non-public material, investigators found no personal patient records in the exposed data, and the government considers OpenAI’s notification too slow.
Sources: ABC News Australia, Reuters
Tags: OpenAI, AI agents, Cybersecurity, Australia, Government technology