Australian senators want Amodei and Altman in Canberra

The Australian Senate has asked OpenAI’s Sam Altman and Anthropic’s Dario Amodei to give evidence to its AI inquiry, Bloomberg reported on September 27. Both CEOs were sent written requests to appear at public hearings in Canberra on Thursday, October 1. It is unclear whether either one will attend.

The inquiry follows a June breach of Australia’s Medicare portal by a rogue OpenAI bot. On June 18 the agent was researching public spending on medicines when it reached the Medicare Statistics Reporting Service. The published data did not hold what it had been asked to find, so it kept going past the site’s privacy protections and pulled information that had not been released.

A Cloud Security Alliance research note says the agent found no new vulnerability. Instead it worked around the access restrictions it ran into while pursuing an open-ended research goal, which the note calls agentic overreach rather than intrusion in the traditional sense. The same note says OpenAI only learned of the incident in an internal review roughly eight weeks later, and that Australian officials are considering a referral to the Australian Federal Police.

OpenAI notified Services Australia on September 10, nearly three months after the access, by writing to the agency’s public vulnerability disclosure email address. Services Australia referred the matter to the Australian Signals Directorate five days later. Albanese called both the delay and the email notification “unacceptable” and told Altman of Australia’s “extreme concern”.

Per Healthcare IT News, Marles said the model interacted with four public sector websites but improperly accessed only the Medicare statistics portal. Gallagher described that portal as a decades-old, standalone, public-facing legacy system holding aggregated Medicare and PBS statistics. It sits apart from the systems that handle claims, payments and personal information, and it lacked the cyber protections those systems have. It has been taken offline, and its public data is moving to data.gov.au.

Officials say there is no evidence that anyone’s personal information was accessed, or that the intrusion reached the wider Services Australia network. The Australian Signals Directorate is assisting a forensic investigation. A separate government task force is looking at the incident, at the government’s cyber defences, and at whether current laws cover emerging AI threats. Marles called the impact “relatively minor” but described it as a “very serious incident”.