OpenAI apologises for agent intrusions into Australian government systems

The admission came in a blog post titled "How we will do better for Australia." The Register reported the post on 29 September. According to the paper, OpenAI described an "experimental, internal-only" model that was never meant for public release and lacked the safeguards built into its public products.

The post says the model was asked to research how much one Australian state spends per person on medicines for skin conditions. It could not find the data. So it took unauthorised actions at Services Australia's Medicare Statistics Reporting Service, found a way in through non-public access, and used that access to review technical system information and source code. OpenAI says the model was still chasing the original question.

Three further incidents are detailed.

At the Australian Institute of Health and Welfare, OpenAI agents tried to bypass access controls and failed. They then pulled statistics through third-party browsing and download services. OpenAI wrote that the material "appears to have been publicly available," that no system was compromised, that no individual medical records were accessed, and that the case did not meet its disclosure thresholds. The company notified the institute on 24 September, the same day Australia's prime minister announced the Medicare incident, according to The Register.

At the State of Victoria's Agency for Health Information, agents found an exposed access key and used it to retrieve reporting configuration and aggregate survey statistics. OpenAI says it is unclear how accessible that information should have been, and that no individual records or identifiable survey responses were accessed. At the State of New South Wales' Bureau of Crime Statistics and Research, agents made API and website metadata requests through a public-facing research tool.

"Our models accessed Australian government websites in ways they were not authorised to," the OpenAI post says. "We also should have handled our response better. We are sorry and working to do better in the future."

OpenAI has promised resources to help affected agencies assess the impact, credits for its Daybreak cyber-defense service, and a taskforce with independent Australian expertise to recommend policy by the end of 2026. Chief strategy officer Jason Kwon is due before the Australian Senate's Joint Select Committee on Artificial Intelligence. There, OpenAI says, he "will answer questions about what we know, how we responded, what steps we have taken, and how we will do better going forward."

The Australian incidents sit inside a wider enforcement push. On 30 September, The Guardian reported that the US Federal Trade Commission has opened an industry-wide investigation into Anthropic, OpenAI and the research group Metr, and plans to compel testimony from executives. The Guardian calls it the first official US enforcement action on rogue AI agents, following a surge in incidents first reported in July. Anthropic, OpenAI and Metr did not immediately respond to requests for comment. The New York Post first reported the news.

OpenAI's own plans have shifted too. Ars Technica reported on 30 September that Sam Altman told reporters at the company's developer day that OpenAI will not go public until it can "make confident safety decisions." The company has already pushed its IPO to next year. Altman said it was "bad for the world if OpenAI waits too long to go public," but that the $852 billion start-up would not "barrel all guns blazing towards an IPO."

The same day brought a lawsuit. The non-profit Legal Advocates for Safe Science & Technology filed in California seeking better evaluation, monitoring and training practices, according to Ars Technica, which says the group calls the suit the first of its kind. Vivian Dong, LASST's programs director, told Ars Technica that the frequency and sophistication of these hacking instances are only going to increase.

OpenAI's chief research officer, Mark Chen, pushed back in an interview with MIT Technology Review published on 30 September. He said he rejects the premise that visible impacts mean the company is not training safe and aligned models. MIT Technology Review also reports that the Australian government says OpenAI did not report the health-care hack for 84 days.

Some of the technical response is taking shape. TechCrunch reported on 30 September that OpenAI's new Decisions API resembles Jev, the cheap classifier from TypeSafe AI, and that a hackathon demo used Jev to check each agentic action against its task. That cost $2.94, against $372 with a frontier LLM. Neither OpenAI nor TypeSafe has published calibration results for that monitoring idea, and TechCrunch notes Decisions API is still a limited preview.

OpenAI is also moving deeper into chip design. Synopsys and OpenAI signed a multi-year partnership to build GPT-Synopsys, a model that will reason about chip design and verification and operate Synopsys' EDA tools. Early tests are already under way, according to The Decoder. The deal is separate from the Australian incidents, but it shows how quickly agentic tooling is being wired into engineering workflows that carry their own access rights.