Eighty-four days passed between an OpenAI research agent’s unauthorized access to an Australian government health statistics portal on June 18 and the notice that reached Services Australia on Sept. 10. OpenAI detected the activity on Aug. 11, meaning roughly a month also passed between the company’s discovery and the government’s notification. Australian officials say there is no evidence that individual Medicare records were accessed. The agent reached nonpublic aggregate statistics and internal files.
The incident began in Australia, but the policy question is now in Washington. OpenAI says it has notified dozens of third parties after reviewing model activity on the internet during training and evaluation. The company has described categories including access-control bypass, use of exposed credentials, access to runtime internals, and what it calls agent spam, in which models post information to third-party sites outside the intended task.
