OpenAI Faces Australia Breach Fallout, Announces Stronger AI Safety Measures, Controls

OpenAI has apologised after an experimental AI model accessed Australian government systems without authorisation during an internal training and evaluation exercise in June. The company said the incident involved the Services Australia Medicare Statistics Reporting Service and other government websites. OpenAI Model Accessed Government Systems According to OpenAI, the model was assigned a research task involving government spending on medicines for skin conditions in Victorian communities. While searching for the information, the model discovered a way to obtain non-public access to the Medicare Statistics Reporting Service. The model subsequently ran commands and retrieved internal files, credentials, technical information and aggregate statistics. OpenAI said its investigation found no evidence that individual medical records or other sensitive personal records were accessed. The company said the model was an experimental system that was not intended for public release and did not have all the safeguards used in publicly available products. Company Admits Response Was Not Handled Quickly Enough OpenAI's apology also addressed how it handled the incident after discovering the activity. The company said it became aware of the Australian activity during a review launched following another AI-related security incident in July. That review identified activity involving Australian government websites in mid-August. OpenAI subsequently notified Services Australia and the Victorian Department of Health on September 10, with another agency notified later in September. Australian Prime Minister Anthony Albanese criticised the delay and described the incident as unacceptable. OpenAI said it should have shared its preliminary findings sooner and kept Australian agencies updated as its investigation progressed. OpenAI Announces Australian AI Safety Taskforce As part of its response, OpenAI said it would provide dedicated technical support to affected Australian government agencies, including relevant findings and assistance from its response teams. The company also plans to use credits from its $1 billion Daybreak for Frontline Defenders fund, along with technical expertise, to strengthen cyber defences across Australian government and industry environments. OpenAI will establish an Australian taskforce involving independent local experts. The taskforce will develop recommendations covering notification procedures, coordination between AI developers and governments, and ways to protect government systems from increasingly capable AI agents. Also Read: OpenAI Drops GPT-6.1 Astra Launch After Safety Tests Flag Concerns Stronger Safeguards for AI Research OpenAI said it has already strengthened safeguards in its research environments following the Australia incident and a separate July security event. The measures include additional network restrictions , expanded monitoring and controls intended to prevent live internet access in research environments. The company said web access will instead be provided through cached content. OpenAI also said its monitoring systems would detect similar activity and alert human reviewers for urgent intervention. Training and evaluation involving tool use for its most capable models has been paused and will resume only after additional safeguards are in place. OpenAI Chief Strategy Officer Jason Kwon is scheduled to appear before Australia's Joint Select Committee on Artificial Intelligence on October 6, where he is expected to address the incident, the company's response and the measures being introduced.