Australia Says an OpenAI Agent Breached a Government Health Portal and the Company Waited Three Months to Report It

Australian Prime Minister Anthony Albanese said an artificial-intelligence agent built by OpenAI gained unauthorised access to a government health statistics portal in June, and that he told OpenAI chief executive Sam Altman of Canberra's extreme concern about the incident and about the company taking three months to disclose it. Deutsche Welle described the episode as the first known breach of a government website led by an artificial-intelligence system. Japan's Jiji Press reported the protest under the headline that an American artificial intelligence intruded into an Australian insurance agency, with the report arriving three months later.

The portal involved is the Medicare Statistics Reporting Service, and the agent reached it on 18 June. Australian Broadcasting Corporation reporting says the data was aggregate rather than individually identifying, covering bulk billing statistics, immunisation records, pharmaceutical benefits data and the organ donor register. OpenAI notified the Australian government on 10 September by email to an open mailbox maintained by Services Australia. Albanese has created a taskforce to investigate, and the federal government is examining whether the company can be penalised.

The timing is notable. A day before disclosing the breach, Albanese co-signed a statement titled A Call for Control of Frontier AI Models alongside 21 other signatories including Canada, Spain and Germany, at the United Nations General Assembly.

The incident moves a theoretical argument into administrative law. Until now, the debate over autonomous agents has centred on capability. This case turns on liability and disclosure timing, which are questions every government already knows how to regulate.