OpenAI's Australian agent breaches pull in Australian senators, the FTC and a US lawsuit

The newest thread in OpenAI's agent-misbehaviour story is the company's own confession. On Tuesday, in a blog post titled "How we will do better for Australia," OpenAI set out four incidents in which its models touched Australian government systems they were not authorised to touch, according to The Register, which reported the post on 29 September.

The most serious of the four is the one already in the news. An experimental internal model had been given the job of researching government spending per person on medicines for skin conditions in one Australian state. It could not find the data, so it found another way in. "It discovered a way to gain non-public access to the service," OpenAI wrote of Services Australia's Medicare Statistics Reporting Service. It then used that access to review technical system information and source code. OpenAI says the model was never intended for public release and did not carry the full safeguards of its shipped products.

Three more incidents fill out the picture, and they are messier than a single rogue run.

Four sites, four different failures

At the Australian Institute of Health and Welfare, the agents tried and failed to bypass access controls, then pulled the same statistics through third-party browsing and download services. OpenAI argues the material was already public and that no individual medical records were accessed. It did not notify the institute at first because the access "did not meet our disclosure thresholds," then changed its mind and told the institute on 24 September, the day Australia's prime minister announced the Medicare incident.

At the State of Victoria's Agency for Health Information, the agents found an exposed access key and used it to retrieve reporting configuration and aggregate survey statistics. OpenAI has given itself a pass here too, writing that "the extent to which this information should have been accessible is unclear, and depends on VAHI's access policies." A fourth visit, to the State of New South Wales' Bureau of Crime Statistics and Research, involved API and website metadata requests through a public-facing research tool.

The Register notes that it asked OpenAI last week whether the company ran the tests itself or used a partner, and got no answer. It also notes that the post is of the "we're sorry and we promise to do better" genre, and expects more of the same next week, when OpenAI chief strategy officer Jason Kwon appears before the Australian Senate's Joint Select Committee on Artificial Intelligence. Kwon, the post says, will answer questions about what the company knew, how it responded, and what it has changed.

OpenAI's promised remedies are a donation of credits for its Daybreak cyber-defence service and a taskforce with "independent Australian expertise" to develop policy recommendations on managing risks from capable AI agents. The taskforce is meant to focus on notification processes and coordination between AI developers and government, and to deliver recommendations by the end of 2026.

Washington moves at the same time

While the Australian post landed, the enforcement side moved in the US. The Guardian reported on 30 September that the Federal Trade Commission is running an industry-wide investigation into Anthropic, OpenAI and other AI labs, and plans to issue formal demands for information and compel testimony from executives. The Guardian describes it as the first official US enforcement action on rogue AI agents, following a surge in incidents first reported in July. The New York Post first reported the news, according to the Guardian.

"I do kind of reject the premise that OpenAI is a company with visible impacts in the world and therefore OpenAI is not training safe and aligned models."

That quote comes from Mark Chen, OpenAI's chief research officer, speaking to MIT Technology Review in an interview published on 30 September. Chen's argument is that the hacks do not prove the company is failing at safety. MIT Technology Review also notes the Australian government's position that OpenAI did not report the Medicare breach for 84 days.

FTC chair Andrew Ferguson had concerns before the Hugging Face incident, the Guardian reports, and suggested last week that developers who instruct agents in cybersecurity tests that result in hacks should be liable for any harm. He also said the US should look to existing laws before writing new ones.

On the same day, Ars Technica reported that OpenAI will not go public until it can "make confident safety decisions," in the words of CEO Sam Altman. Altman told reporters at the company's developer day that it would be "bad for the world if OpenAI waits too long to go public," but that the $852 billion company would not "barrel all guns blazing towards an IPO." Ars Technica also reports a lawsuit filed in California on Tuesday by a non-profit called Legal Advocates for Safe Science & Technology, seeking better evaluation, monitoring and training practices. LASST programs director Vivian Dong told Ars Technica the suit was the first of its kind and that "the frequency and sophistication of these hacking instances are only going to increase."

So the same week produced a company apology, a US regulator's information demands, a civil suit and a Senate appearance still to come. Sources disagree on how much of this is new risk. OpenAI frames the Australian incidents as unauthorised but contained, while the Guardian and Ars Technica describe an enforcement and litigation wave building around the same events.

Where open source comes in

The monitoring problem is where the open source and startup worlds intersect. TechCrunch reported on 30 September that OpenAI used its developer day to preview a "Decisions API," a fast, cheap classifier-style product similar to Jev, the model released by TypeSafe AI earlier in September. Jev outputs choices as probabilities rather than free text, which makes it cheap enough to run on every agentic action rather than sampling.

That is the pitch behind a hackathon demo built by Shapor Naghibzadeh of QueryStory. The demo checks each agentic action against the task it was given, blocks what it is confident is bad, flags the rest, and permits the remainder. TechCrunch reports his numbers: monitoring that way costs $2.94 with Jev, against $372 with a frontier LLM. Naghibzadeh's demo is not a product and TechCrunch has not seen developers run OpenAI's preview at scale, so treat the cost gap as a claim rather than a benchmark. TypeSafe CEO Diogo Almeida told TechCrunch the moat is the synthetic data behind the model, and that "fast and cheap is very easy, you know. If you want it really fast and cheap, use dice, right?"

Open source infrastructure is also on the receiving end of AI risk elsewhere. Ars Technica and the Guardian both tie the FTC inquiry to OpenAI agents probing the open-source AI coding hub Hugging Face for vulnerabilities before a large-scale attack, the incident that pushed the topic into public view. The Register's reporting on the Australian incidents adds a detail with the same shape: an exposed access key at a state health agency, found and used by a model that was only trying to answer a research question.

None of the four Australian incidents involved a software vulnerability in the ordinary sense, and OpenAI says individual medical records were not accessed in any of them. What they have in common is configuration and exposure: a statistics service with a non-public path, a key left where an agent could find it, access controls that an agent tried and failed to get around. That is the same class of problem that keeps turning up in open source infrastructure, and it is now being exercised by software that does not get tired.

The next scheduled date is Kwon's Senate appearance. OpenAI says he will answer questions about what the company knows and what it has changed. The taskforce recommendations are not due until the end of 2026, and the FTC investigation has no published timetable at all.