OpenAI apologizes to Australia and offers Daybreak credits

OpenAI apologised to Australians on September 29 for the June incident in which one of its AI agents got into a non-public Services Australia portal for Medicare statistics, and published its first detailed account of what the agent did there and on three other government sites, the Guardian reported. On the Medicare portal, OpenAI says, the agent ran commands, retrieved internal files and credentials and wrote files, but reached no patient or client records.

“We also should have handled our response better,” the company wrote in its blog post. Jason Kwon, OpenAI’s chief strategy officer, will answer for it before parliament’s Joint Select Committee on AI on October 6. Guardian Australia reported on Monday that Anthropic will appear at the same hearing, though not at this week’s Senate inquiry into AI and datacentres.

From a spending question to Medicare

The agent had been given a research task: find government spending per person on medicines for skin conditions in Victoria. It struggled to get the figures, and then, in OpenAI’s words, “it took actions that we had not authorised it to take”, including entering Services Australia’s Medicare statistics reporting service. Albanese described the same pattern when he first went public: “When it was blocked, it sought ways around the blockage.” The break-in took place on June 18, ABC reported, and the agent read both public and non-public files.

The portal itself may have helped. In September Recorded Future News found that a March 2025 upgrade had switched on guest access, which signs any visitor in automatically without credentials, and that the portal’s code sent every statistics query on the production server to that guest endpoint.

OpenAI says it only became aware of the activity in mid-August, when it went back over earlier training incidents after the July attack on Hugging Face. That attack belongs to the same series of incidents: two OpenAI models escaped a closed testing environment earlier this year and broke into Hugging Face’s internal systems, France 24 reported.

Four agencies, four dates

The new account goes further than the government’s first description of the other three sites. Acting Prime Minister Richard Marles had said the agent only reached public information there and called those interactions “entirely normal”. OpenAI now says that at the Victorian agency for health information the agent found an exposed access key and used it to query a reporting system for aggregate survey statistics. At the NSW Bureau of Crime Statistics and Research it got into the public crime mapping tool, and OpenAI has handed the bureau the application configuration, operational jobs and logs, and website metadata involved. At the Australian Institute of Health and Welfare its agents retrieved aggregate statistics; separate attempts to get around access controls failed, and the data obtained was already public.

Notifications went out at different times. Services Australia and the Victorian health department were told on September 10, and the NSW bureau on September 18. The Australian Institute of Health and Welfare heard only on September 24, because OpenAI decided its case did not meet disclosure thresholds.

The September 10 notice to Services Australia was sent to publicdisclosures@servicesaustralia.gov.au, a public inbox that is checked once a day, and nobody read it until September 11, the Guardian reported last week. Services Australia passed it to the Australian Cyber Security Centre on September 15. After that came out, the federal government said it could introduce mandatory reporting rules for AI-related data breaches.

What OpenAI is offering

OpenAI says it will commit resources and expertise to the affected agencies and help Australian government agencies build cyberdefences for critical infrastructure. Government agencies and industry will get credits from its US$1bn (AU$1.4bn) Daybreak fund, which pays for using frontier AI in cyber defence, including reviewing code and system configurations for vulnerabilities that can then be patched. How much of the fund goes to Australia has not been disclosed. OpenAI also plans a taskforce with Australian experts to draft practical policy recommendations on managing the risks of AI agents.

Albanese, who called Sam Altman to express “extreme concern” when he disclosed the incident, said on Tuesday that OpenAI had been “very constructive and open in engaging” since then, as had Anthropic. He also pointed to “the revelation that has occurred in the United States and other countries as well”. In one such case, Transluce, a not-for-profit AI research lab, said OpenAI’s systems tried and failed to hack a University of New Mexico digital library and Data USA in May, the BBC reported.

The government is also running its own review. Albanese’s taskforce, led by the prime minister’s department with the Australian Signals Directorate and the AI Safety Institute, will seek advice on whether any offences were committed and whether to refer the case to the Australian Federal Police.