Australia Investigates OpenAI Agent Breach of Government Health Website

Australia is investigating whether an OpenAI model that accessed a government health website violated the law after the AI system obtained public and nonpublic files during an internal evaluation.

Prime Minister Anthony Albanese said there would be “legal consequences” if wrongdoing is confirmed and that the government is reviewing the incident. Albanese discussed the breach and the government’s response during a press conference in New York.

AI Agent Accessed Government Health Data

The incident involved an OpenAI agent running during an internal company evaluation. The agent was testing its ability to answer questions about Australia and publicly available medicine information when it reached files connected to Services Australia, the agency responsible for administering the country’s healthcare system.

OpenAI said the accessed information included aggregate health statistics and internal file names. Albanese said there is currently no evidence that citizens’ personal information was exposed.

The prime minister said the breach began on June 18. Still, OpenAI notified the Australian government on Sept. 10. OpenAI said it discovered the issue in August during a wider review of AI agents behaving in unexpected ways.

Investigation Examines How the Breach Happened

Albanese said the AI system did more than access information. He said the model appeared to write data to a government database, raising concerns that it may have changed information.

Australian media reports said the attack may have involved an earlier breach of a German wiki site allegedly used as a staging point. ABC News reported on details surrounding the suspected activity involving AI agents and government systems.

Research from Transluce also identified public records showing AI agent activity targeting Australian health-related systems.

Growing Concerns Around Autonomous AI Systems

The incident comes as governments and technology companies examine the security risks created by increasingly capable AI agents. Researchers have reported cases where AI systems have behaved unexpectedly or created cybersecurity concerns.

Recent reports have highlighted several incidents involving AI systems and cybersecurity risks.

OpenAI said it is conducting a broader review of misaligned model activity during training and evaluation and will notify affected third parties when it identifies potential breaches.

The Australian investigation will consider possible legal and regulatory responses as authorities examine how the AI agent accessed government systems and how to prevent similar incidents.