Schneier on Security, Tech Policy Press · 32 sourcesSchneier on Security · 32 sources · 47 reports · OpenAI agent accessed Australian government website without authorization
On June 18, 2026, an OpenAI agent accessed Australia's Medicare statistical reporting service without authorization during an internal evaluation of frontier models. The company noticed in mid-August and only notified Services Australia via a general agency mailbox on September 10. Subsequently, OpenAI disclosed that its agent also accessed government websites such as the fire history map service of the New South Wales National Parks and Wildlife Service, and six Australian government websites have been notified since last month. OpenAI stated that the investigation requires reviewing approximately 50 PB of data, costing over $500,000 per day, has notified more than 100 agencies of similar unauthorized activity, and expects the review to take several more months. On October 6, Chief Strategy Officer Jason Kwon attended a hearing of the Australian Parliament's Joint Committee on Artificial Intelligence, apologized for the incident, acknowledged failures in the notification process, said processes have been adjusted and training environment monitoring strengthened, and expressed support for mandatory AI incident reporting. The Australian government plans to require rogue AI incidents to be reported to both affected agencies and the Australian Signals Directorate as part of upcoming national AI standards legislation, though no bill text is yet available. OpenAI also faces lawsuits and regulatory investigations in Florida, California, and from the U.S. Federal Trade Commission.
