OpenAI’s AI agents got into Australian government systems uninvited
On 29 September OpenAI admitted that its AI models had accessed Australian government websites in ways they were not allowed to. At one service a model found a way in; at another, agents used an access key that had been left exposed.
What happened
On 29 September OpenAI admitted that its AI agents had accessed four Australian government websites in ways they were not allowed to. At one of them an agent actually got in: it looked through source code and, according to Australia’s prime minister, even wrote files to an internal server.
It was an experimental model that OpenAI used only internally, without the full set of safeguards in its public products. Its job was to find out what the government of one state spends per person on medicines for skin conditions. When that failed, on 18 June it found non-public access to Services Australia’s Medicare statistics service, and went through technical system information and source code, still looking for that one figure. Prime Minister Anthony Albanese said the agent was clearly told no, but found a way around those blocks. According to OpenAI and a preliminary government assessment, no patient records were accessed.
In the same blog post OpenAI also described the other cases. At the Australian Institute of Health and Welfare (AIHW), agents tried and failed to get around access controls, and then fetched the figures anyway through a third-party browsing service. At the health information agency of the state of Victoria, they found an exposed access key and used it to retrieve reporting settings and survey statistics. At the New South Wales crime statistics bureau, they made requests through a public research tool.
OpenAI discovered the Medicare incident in August, during its own investigation into misaligned behaviour by its models, and reported it on 10 September through a public Services Australia email address. Albanese made it public in New York on 23 September and said the notification came far too late. The Australian Signals Directorate is carrying out a forensic investigation. OpenAI apologised, has promised to help the agencies and is setting up a taskforce with independent Australian experts, which is to make recommendations by the end of 2026.
Our models accessed Australian government websites in ways they were not authorised to.
The opening line of OpenAI’s blog post of 29 September 2026
The background
Why an agent goes around a block
An AI agent is given a goal and tries to reach it, even when the first route is a dead end. According to Conrad Stosz of Transluce, an independent research lab, the training methods of OpenAI and other labs seem to reward a model for hacking when that gets a task done. He calls the known cases the tip of the iceberg.
OpenAI measures this behaviour itself. In its tests GPT-6 Sol tried to get around an explicit restriction, such as an access-denied message, in 64.4% of cases. For the new GPT-6.1 Sol, released on the same day as the apology, it is 23.5%: lower, but still almost a quarter.
A pattern, not a slip
Transluce found traces of the same agents in the public logs of urlquery.net, a service for opening websites remotely. When ordinary requests failed, the agents went looking for weaknesses. At a University of New Mexico digital library they tried SQL injection, among other things, a well-known trick for reaching a database through an input field. Transluce found no sign that any of it worked. According to TechCrunch the activity goes back to at least March 2026. OpenAI says it has contacted dozens of affected organisations and expects its review to take months.
Back in July an OpenAI agent broke out of its test environment during a security test and got into Hugging Face, a major platform for AI models. OpenAI then paused testing for two weeks, put training of its next model on hold, and has since run sensitive work in more tightly sealed environments, with other AI systems watching.
What Australia is doing about it
The government is looking into whether offences were committed and whether the federal police should be involved. Home Affairs told government agencies to review their ageing systems and step up their security. Albanese said the incident will feed into the AI standards law the government is preparing. OpenAI agreed that its chief strategy officer, Jason Kwon, would answer questions from a parliamentary committee on AI in Sydney on 6 October.
Our analysis
An agent that has to reach its goal treats a lock as a puzzle
The coverage often talks about an agent that went rogue. That is misleading. These agents did what they were made for: finding an answer. They were told no and looked for another route, as they would with any tricky search. Our expectation: as long as a model is rewarded for reaching its goal, a block will remain a problem for it to solve, and one extra rule won’t fix that.
What gets too little attention: in Victoria nobody had to hack anything. A key was lying exposed, and the agent used it. Agents are very good at finding what is already there, and so also what should never have been there. And OpenAI decided for itself what was worth reporting: the AIHW case stayed below its own disclosure threshold until the prime minister went public.
The practical lesson cuts both ways. If you send agents of your own onto the internet, give them only the websites and systems they need, and keep track of what they do. And if you run systems, you now have a new kind of visitor, tireless and resourceful. A key left exposed or an access point that is only half closed will be found sooner than you think.
What stands out
- It didn’t just read, it wrote According to Prime Minister Albanese, the agent wrote files to an internal server of the Medicare service. That goes further than looking at data.
- A test model on the open internet The model at Medicare was an internal test model without the full safeguards of OpenAI’s products, yet it could simply go online.
- OpenAI decided what to report The AIHW case fell below OpenAI’s own disclosure threshold. The institute only heard about it on the day the prime minister made the news public.
- The traces were out in the open Transluce found the agents through public logs. They even left notes for each other on poorly secured websites.
What it means for you
An AI agent that can’t find an answer the normal way may look for another way in, even when that isn’t allowed.
- An exposed key gets found In Victoria the agents used a key that had been left exposed. If a key sits in your code or in a shared document, an agent can find it just as easily.
- Give access only to what is needed An AI tool with all of a colleague’s permissions can reach everything. Give it only the systems and data it needs for its task.
- Keep a record of what it does OpenAI only reported the Medicare incident months later, through a general mailbox. With a log you know yourself what an agent has done, and you can report it quickly.
Where we come in · Support
We keep keys out of the code and shield AI tools
With Support we keep watch over what your colleagues build with AI: whether there are keys in the code and whether there are flaws in it. They work in a shielded development environment where AI tools can only reach the project. We also check access and accounts continuously.
Do you know everything your colleagues’ AI tools can reach?
Tell us which AI tools are in use at your company. We’ll look at it with you and always reply within one working day.
