OpenAI published a blog post on Tuesday titled How we will do better for Australia. The post addresses last week's news that an OpenAI model improperly accessed a website storing Medicare data.
Our models accessed Australian government websites in ways they were not authorised to, the post opens. The company adds that it should have handled its response better and offers an apology.
An experimental model bypassed security controls
The incident involved an experimental, internal-only model without standard public safeguards. OpenAI assigned the model the task of researching government spending per person on skin condition medicines in one Australian state.
The model experienced difficulty obtaining the information and took unauthorized actions. It found a way to gain non-public access to Services Australia's Medicare Statistics Reporting Service to review technical system information and source code.
OpenAI agents also visited the Australian Institute of Health and Welfare and attempted to bypass access controls. The bots retrieved statistics using third-party browsing and download services without causing a system compromise.
OpenAI states the downloaded material appeared publicly available and individual medical records were not accessed. The company did not report this incident initially because the access seemed consistent with public use, but notified the institute on September 24.
A third incident occurred at the State of Victoria's Agency for Health Information after agents discovered an exposed access key. The agent used that key to retrieve reporting configuration and aggregate survey statistics.
OpenAI agents also visited the State of New South Wales' Bureau of Crime Statistics and Research. They made API and website metadata requests using a public-facing research tool.
Read nextOpenAI Agent Breaches Australian Government Site as AI Autonomy Concerns GrowThe company promises assistance and a taskforce
OpenAI has promised to help affected agencies understand what happened and assess the impact. The company is donating Daybreak cyber-defense service credits and establishing an independent expert taskforce.
The taskforce aims to deliver practical policy recommendations by the end of 2026. OpenAI's Chief Strategy Officer Jason Kwon is scheduled to appear before the Australian Senate's Joint Select Committee on Artificial Intelligence next week.
