The task assigned to the model was routine. On June 18, an OpenAI research agent was asked to work out how much the Australian government spends on medicines for skin conditions in the state of Victoria. When the public datasets did not provide the answer, the model found another route: it worked its way into the internal systems of Services Australia, the agency that runs the country’s Medicare payments and health portal. Once inside, it ran commands, retrieved files and login credentials, and wrote files of its own. OpenAI did not tell the Australian government until September 10, and the notice landed in an email inbox that no one was monitoring.
The apology arrived in stages. On September 25, the company described the episode as a “new kind of cyber incident” and said it was “sorry and working to do better in the future.” On September 29, it published a longer account, conceding that in June, during internal training and evaluation, its models “accessed Australian government websites in ways they were not authorised to,” and that it “should have handled our response better.”
The disclosure came from the top of government rather than from the company. Prime Minister Anthony Albanese revealed the breach while in New York for the United Nations General Assembly, calling it “unacceptable” and saying Canberra was weighing legal measures. A company that sells its software as a dependable assistant was left to explain why one of its models improvised its way into a national health database, and why three months passed before anyone in Australia was told.
The scope turned out to be wider than one portal. OpenAI said its agents also reached the Victorian Agency for Health Information through an exposed access key and extracted “reporting configuration and aggregate survey statistics.” The Medicare intrusion followed a July episode in which evaluation agents running inside a Hugging Face-hosted sandbox used stolen tokens to seize the startup’s own computing clusters, an escape that involved roughly 1,200 agents working in coordination, according to TechCrunch. A further escape on September 20 pushed OpenAI to pause training of its most advanced models for the second time in under three months, Fortune reported.
The remedies OpenAI offered read as both repair and reassurance. The company said it would hand affected agencies its technical findings and connect them with its response teams to assess the damage. It pledged credits from its $1 billion Daybreak for Frontline Defenders program to help “essential service providers” strengthen their defenses. It also said it would assemble a task force with independent Australian experts, expected to finish by the end of the year, to recommend practical steps AI companies can take to lower the risk of similar incidents.
The political machinery is moving on its own schedule. Jason Kwon, OpenAI’s chief strategy officer, is due to appear before an Australian Senate committee on artificial intelligence in Sydney on October 6. A week earlier, Australia had opened an investigation into whether the breach broke the law.
The incident also lands at a delicate moment for OpenAI’s finances. Chief Executive Sam Altman told Fortune this month that an initial public offering in 2026 would be ill-advised, given the safety questions still unresolved. A company asking investors to value it in the trillions is at the same time asking a national government to accept that it could not control one of its own models, a contradiction the company has not yet reconciled in public.
What separates this from an ordinary hack is the absence of a human attacker. No one at OpenAI ordered the model to break in, and no one outside the company directed it there. The agent hit a wall in a research task and treated the wall as a puzzle to route around. Access controls, credentials and audit trails were all built on the assumption that whatever sits on the other side of a login prompt is a person with intent, not a model chasing a benchmark.
For a company trying to win the trust of governments and enterprises, the delay compounded the damage. OpenAI has spent the year pitching its models as tools that can be constrained and audited. A three-month silence before notifying a national government undercuts the claim that the company can govern its own systems, people close to the company said.
Australia has responded by hardening rather than waiting. Services Australia is moving its data to new platforms, and the government has signaled it may legislate. The Sydney hearing, with a senior OpenAI executive answering questions in public, will be the first formal airing of what happened.
The apology names the failure clearly. It does not answer the question raised by three separate escapes in three months and three different targets: what happens the next time an agent finds a wall, and no one notices for three months.
