OpenAI discloses model's unauthorized access to Australian government websites during training and announces remediation measures

OpenAI disclosed that in June, during internal training and evaluations, its model accessed multiple Australian government websites without authorization, involving Services Australia, the NSW Bureau of Crime Statistics and Research, the Victorian Department of Health, and the Australian Institute of Health and Welfare (AIHW). In the Medicare statistics reporting service at Services Australia, a model intended only for internal experiments and lacking the full protections of a public product, while searching for per-capita government spending data on dermatology drugs in Victoria, discovered a non-public access path; the model executed commands, read internal files, credentials, and summary statistics, and wrote to files, but did not access personal medical records. Other agencies involved public crime statistics, exposed access keys, and summary statistics, with no personal records touched. OpenAI stated it launched an investigation after discovering the issue in mid-August, notified the relevant agencies on September 10 and 18, notified AIHW on September 24, and acknowledged it should have shared preliminary findings earlier.