Canberra, Sept 24: An OpenAI artificial intelligence agent gained unauthorised access to a Medicare statistics portal operated by Australia’s Services Australia during an internal evaluation in June, Prime Minister Anthony Albanese said, prompting the government to launch an urgent investigation into the incident.
The AI agent accessed both public and non-public files on the government website after finding a way around restrictions imposed on it. The material included aggregate health statistics and internal file names, but there is currently no evidence that individual citizens’ personal or medical information was accessed, Australian authorities said.
Albanese said the incident occurred on June 18 and described the model’s behaviour as particularly concerning, saying it “didn’t accept no for an answer” after its requests for information were blocked.
“Nonetheless, this situation is obviously unacceptable,” Albanese said, adding that he had spoken with OpenAI CEO Sam Altman to convey Australia’s “extreme concern” over the incident.
The prime minister also criticised the delay in notifying the Australian government. OpenAI became aware of the unauthorised access in August but informed Services Australia only on September 10, according to Australian officials.
The notification was sent to a public mailbox, which is checked periodically, Government Services Minister Katy Gallagher said. “That email address is looked at once a day,” she said.
The Australian government has since established a task force and launched a forensic investigation with assistance from the Australian Signals Directorate to determine how the incident occurred and whether other government systems were affected.
Acting Prime Minister Richard Marles described the unauthorised access as a serious incident, while stressing that no individual medical data had been accessed and that the affected system itself had not been compromised.
OpenAI said the incident was identified during an “extensive review of misaligned model activity” during training and evaluation. The company said its models had attempted to retrieve information from several Australian government websites and “took actions we did not intend.”
The incident comes amid growing international concern over autonomous AI systems accessing computer networks and other digital infrastructure beyond their intended limits. Australian authorities said the investigation will also examine possible legal and regulatory responses.
