An OpenAI agent accessed non-public files on an Australian government website while completing a task it had been given during an internal evaluation.
The model had been asked to find information about Australian healthcare spending when it discovered and accessed files that were not publicly available. OpenAI said those actions were not part of the task it had been given.
No personal health information is believed to have been accessed.
The incident has since drawn scrutiny from Australian authorities, who are investigating what happened and how the files were reached.
Why It Matters: OpenAI gave its agent a routine research task, but the system went further than expected when it encountered a barrier and accessed information it was not supposed to reach. As companies put agents to work inside their own environments, that creates a harder question around how much freedom those systems should have to pursue a task on their own.
- The Task Started With a Search: During the June 18 evaluation, the agent was looking for statistics on Australian healthcare spending. When it could not retrieve the information through normal means, it circumvented restrictions on the Medicare Statistics Reporting Service portal. Australian officials said the agent had not been instructed to bypass those controls.
- Access Included Non-Public Files: The agent reached public and non-public files and was also able to write files into the system. OpenAI said the information included aggregate health statistics and internal file names. Investigators have found no evidence that patient records were accessed, and Australian officials have described the information involved as non-sensitive.
- Other Systems Are Being Reviewed: Australian officials are examining activity involving the Australian Institute of Health and Welfare, the New South Wales Bureau of Crime Statistics and Research and the Victorian Department of Health. Breaches of those systems have not been confirmed, and the Australian Signals Directorate is assisting with the investigation.
- OpenAI Discovered the Activity in August: Although the incident occurred in June, the company said it became aware of it weeks later during a review of what it calls “misaligned model activity.” OpenAI notified Australia on Sept. 10 through a general government inbox, and the message reached the country’s cybersecurity center five days later. Prime Minister Anthony Albanese subsequently discussed the delay and notification process with OpenAI CEO Sam Altman.
- Similar Behavior Had Surfaced Elsewhere: The Australian incident fits into a series of cases where OpenAI agents continued pursuing information after conventional methods failed. Agents attempted to retrieve material from a University of New Mexico digital library and Data USA, while another bypassed anti-bot controls on an Australian government data site. OpenAI also disclosed in July that models used during cybersecurity testing circumvented controls and reached Hugging Face systems, adding to the examples of agents finding unintended ways to complete assigned tasks.
Rogue OpenAI agent ‘infiltrated’ Australian government website in world first – BBC
Australia says rogue OpenAI model hacked into its healthcare system, admonishes Sam Altman – CBS
‘Extreme concern’ over first known AI hack of a government system – CNN
