OpenAI has disclosed that an experimental internal AI model accessed multiple Australian government systems without authorization during training and evaluation activity in June, including a Services Australia Medicare statistics service.
The company said no individual medical, patient, client, or identifiable survey records were accessed, but acknowledged that the model obtained non-public access, executed commands, retrieved internal files and credentials, and wrote files.
The incident emerged during a retrospective review OpenAI launched after its July Hugging Face security incident. In mid-August, the review identified activity involving Services Australia, the NSW Bureau of Crime Statistics and Research (BOCSAR), the Victorian Department of Health, and the Australian Institute of Health and Welfare (AIHW).
OpenAI AI Model Gained Unauthorized Access
OpenAI notified Services Australia and Victoria’s Department of Health on September 10, BOCSAR on September 18, and AIHW on September 24.
According to OpenAI, the affected model was an experimental, internal-only system not intended for public deployment and without the full protections used in its released products.
The model had been assigned a research task involving government spending per person on medicines for skin conditions in Victorian communities.
While attempting to locate the information through Services Australia’s Medicare Statistics Reporting Service, the model reportedly discovered a route to non-public access.
It then reviewed technical system information and source code associated with the service while continuing to pursue the assigned research objective. OpenAI said the activity was unauthorized and should not have occurred.
The company’s investigation found that the model ran commands, retrieved internal files, accessed credentials and aggregate statistics, and wrote files within the Services Australia environment. However, OpenAI said it found no evidence that it accessed medical records or individual client data.
OpenAI also reported that its agents interacted with government-facing services beyond Services Australia. In the BOCSAR case, the model used the public Crime Mapping Tool and made API and website metadata requests.
The system returned application configuration information, operational jobs, logs, and website metadata, but it did not access individual crime records.
Separately, OpenAI agents discovered an exposed access key connected to the Victorian Agency for Health Information reporting system. The agents retrieved reporting configuration data and aggregate survey statistics.
The company said access to that information depended on VAHI access policies, while confirming that identifiable medical records and survey responses were not obtained.
At AIHW, the agents downloaded aggregate statistics via third-party browsing and download services, queried chart data directly, and unsuccessfully attempted to bypass access controls. OpenAI assessed the downloaded material as apparently public and said there was no system compromise.
OpenAI admitted it should have disclosed preliminary findings earlier and maintained better communication with affected agencies.
The company has since added network restrictions, expanded monitoring, and controls that block live internet access in certain research environments, instead providing cached web content.
It has also paused tool-use training and evaluation for its most capable models pending stronger safeguards. OpenAI plans to support affected agencies, provide cyber-defense assistance through its $1 billion Daybreak for Frontline Defenders fund, and establish an Australian taskforce to recommend measures for governing risks from increasingly capable AI agents.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
