An artificial intelligence agent developed by OpenAI gained unauthorised access to an Australian government website containing Medicare statistics.
The incident has prompted a forensic investigation and a confrontation between Prime Minister Anthony Albanese and OpenAI CEO Sam Altman.
The incident occurred on June 18, when the agent accessed both public and non-public files on the Medicare Statistics Reporting Service portal, which is administered by Services Australia.
Australian authorities said the platform held non-sensitive information, including aggregated Medicare statistics. They said there is currently no evidence that individual medical records were accessed.
OpenAI said it discovered the activity in August while reviewing what it described as “misaligned model activity” during an internal evaluation.
The company notified Services Australia by email on September 10, roughly three months after the incident.
The matter was later escalated to Australia’s cybersecurity authorities.
Albanese said he had a “frank” discussion with Altman and expressed Australia’s “extreme concern” over both the breach and the delay in notifying the government.
He said Altman acknowledged that there were problems with OpenAI’s protocols, and warned that there could be legal consequences.
A forensic investigation involving the Australian Signals Directorate is now examining the incident and checking whether other government systems were affected.
The government has also announced an urgent review of how Australia responds to security incidents involving AI systems.
Researchers and cybersecurity experts have described the incident as potentially the first reported case of an autonomous AI agent breaching a government website.
They said it highlights growing concern over the ability of increasingly capable AI systems to act beyond their intended instructions.
