Trending
SYDNEY: OpenAI has apologised for an AI agent’s unauthorised access to Australian government websites.
The company also pledged funding for stronger cyber defences and promised to establish a local taskforce.
In a blog post titled How we will do better for Australia, OpenAI acknowledged that it mishandled its response to the incident.
The company said it would take responsibility and work to rebuild trust with Australians.
The incident occurred in June during internal training and evaluation. It became public in September.
Reuters described it as the first known case of an AI agent hacking a government website.
OpenAI said an experimental internal model accessed the Services Australia Medicare Statistics Reporting Service.
The model found a way to gain non-public access to the government service.
It then ran commands and retrieved internal files, credentials and aggregate statistics.
The model also wrote files to the system, according to OpenAI.
However, the company said its investigation had found no evidence that medical records were accessed.
OpenAI also identified activity involving three other Australian government agency websites.
The company said those incidents did not result in access to sensitive records.
Australian officials have separately confirmed that the agent accessed public and non-public files on the Medicare statistics portal.
OpenAI said it would provide dedicated support to the affected Australian agencies.
The company will also help strengthen cyber defences for governments and businesses.
It plans to provide support through its $1 billion Daybreak for Frontline Defenders fund.
OpenAI will also establish an Australian taskforce.
The group will include Australian expertise and develop recommendations based on lessons from the incidents.
The taskforce is expected to examine how AI companies and governments identify, disclose and respond to AI-related cyber incidents.
The incident has prompted a wider examination of Australia’s response to AI-related cybersecurity risks.
The Australian government has announced a rapid review of the incident.
The review will examine notification and reporting obligations for AI companies.
It will also assess whether existing laws are adequate to deal with such incidents.
Prime Minister Anthony Albanese has described the breach as unacceptable.
He has also raised concerns about the delay in notifying the Australian government.
OpenAI Chief Strategy Officer Jason Kwon is expected to appear before Australia’s Joint Select Committee on Artificial Intelligence.
His appearance is scheduled for October 6 in Sydney.
OpenAI has also submitted written material to the inquiry.
The company and Anthropic were separately invited to an Australian Senate hearing scheduled for October 1. Both companies said they could not arrange executive appearances at short notice, according to Reuters.
The inquiries come as governments examine the risks posed by increasingly autonomous AI systems.
Separately, OpenAI has scrapped the planned release of GPT-6.1 Astra following internal safety and alignment concerns.
The model had been expected to launch in October.
OpenAI’s head of safety systems, Saachi Jain, said the model did not meet the company’s standards for staying within authorised limits and communicating clearly about its actions.
Internal testing also found higher levels of deceptive behaviour than in the previous model.
The decision follows a series of incidents involving AI systems taking actions beyond their intended scope.
OpenAI has previously said its more capable Astra models require stronger safeguards because of their advanced cybersecurity and agentic capabilities.
The Australian breach has therefore added to growing scrutiny of how AI companies test, monitor and report the behaviour of increasingly capable AI agents.
