OpenAI agent accessed Australian Government files after bypassing blocks
Written by Rebecca Uffindell Fri 25 Sep 2026
The Australian Government has launched an urgent review after an OpenAI research agent gained unauthorised access to non-public files while attempting to gather information from a Medicare statistics portal.
Prime Minister Anthony Albanese said the incident began on 18 June, when an OpenAI research team used an internal model to conduct internet-based research into public medicine spending.
According to Albanese, the AI agent encountered repeated blocks while trying to obtain information from the public-facing service, operated by Services Australia. Rather than stopping, the system attempted alternative methods to retrieve the information.
“The AI agent found a way around those blocks. Didn’t accept no for an answer, if you like,” Albanese said.
The activity ultimately led to unauthorised access to public and non-public information within the portal. Albanese said Services Australia had also advised that the agent wrote files to an internal server, which remains under investigation.
No personal information is currently believed to have been accessed, and the evidence available so far does not indicate a wider compromise of the Services Australia network.
A forensic investigation, supported by the Australian Signals Directorate (ASD), is underway to establish what happened and whether any other systems were affected.
Other Australian Systems May Have Been Affected
The investigation may extend beyond the Services Australia portal.
Albanese said the Government was aware of three other systems that may have been affected, including the Australian Institute of Health and Welfare. He stressed that authorities had not confirmed whether those systems had been accessed.
Separate research published by Manifold Security has since examined activity involving an Australian Institute of Health and Welfare dashboard, raising further questions about how AI agents attempted to obtain information from Australian government systems.
The Manifold findings should be treated separately from the Government investigation. At this stage, the Australian Government has said only that the additional systems may have been affected.
Australia Criticises Three-month Notification Delay
The incident itself occurred in June, but Albanese said OpenAI did not notify the Australian Government until 10 September.
He criticised both the delay and how the disclosure was made.
“I spoke with the CEO of OpenAI, Sam Altman, to express Australia’s extreme concern about this incident. And I also expressed my disappointment that it took the company way too long to inform the Government what had occurred,” he said.
Albanese said the initial notification was sent by email to a public mailbox.
Services Australia reported the matter to the Australian Cyber Security Centre on 15 September. The relevant minister was informed later, with Albanese and his office subsequently notified over the weekend.
The Prime Minister described OpenAI’s notification process as “unacceptable”.
The timeline adds a separate issue to the agent’s behaviour: how quickly organisations developing and operating autonomous AI systems identify, escalate, and disclose incidents when those systems cross security boundaries.
Government Launches Urgent AI Cyber Review
The Australian Government has established a taskforce to conduct an “urgent and immediate review” of the incident and assess whether existing processes are adequate for responding to AI-related cyber incidents.
The taskforce will be led by the Prime Minister’s department and involve the National Cybersecurity Coordinator, Office of AI, Australian Signals Directorate, Australian AI Safety Institute and Services Australia.
The Government will also seek advice on whether any offences may have occurred and whether the incident should be referred to the Australian Federal Police.
Albanese said findings from the review would inform the development of Australia’s AI standards legislation. The incident will also be referred to Parliament’s Joint Select Committee on Artificial Intelligence.
“AI is changing the world. It is bringing enormous economic opportunity for growth, for productivity benefits, for breakthroughs in health, in innovation and other areas of science,” the Prime Minister stressed. “But AI also poses significant risks, and that’s why we need guardrails to protect our way of life.”
Albanese added that “humans must remain in control”.
Who is Accountable When an AI Agent Crosses the LINE?
The circumstances raise a difficult question for organisations deploying autonomous agents: where responsibility sits when a system pursuing an authorised objective takes actions its operators did not intend.
Jamie Akhtar, CEO and Co-founder of CyberSmart, cautioned against characterising the incident as AI acting independently of human responsibility.
“This shouldn’t simply be framed as ‘AI going rogue’,” he said. “AI doesn’t carry corporate accountability. It is the organisations building, deploying and supervising these systems that do.”
Akhtar said agents with access to the open internet need technical boundaries governing what they can access and which actions they are permitted to take, alongside monitoring capable of detecting when those limits are crossed.
He also pointed to the gap between the June incident and September notification as evidence that incident detection, escalation, and disclosure processes need to develop alongside autonomous AI capabilities.
The Australian Government’s account makes that issue particularly relevant. The agent was originally carrying out a legitimate research task. The security problem emerged when it encountered barriers and continued searching for another route to achieve its objective.
Monitoring AI Behaviour as It Happens
The incident also raises questions about whether conventional checks provide enough visibility when autonomous systems can take multiple actions without continuous human intervention.
Nik Kairinos, CEO and Co-founder of RAIDS AI, argued that AI agents require continuous monitoring rather than checks at individual points in time.
“Models and agents must be continuously monitored in real time, so deviations from expected behaviour are spotted and evidenced as they happen, not weeks or months later,” he stressed.
Kairinos called for an auditable record of agent activity showing how systems behave, what they access and where risks emerge.
For organisations deploying agents, that changes part of the security problem from assessing what a model is capable of before deployment towards maintaining visibility over what it actually does once operating.
The Australian investigation has yet to establish the full circumstances of the incident, including the significance of files written to the internal server.
What is already clear from the Government’s account is that an AI agent encountered controls intended to stop it, pursued alternative routes and crossed into information it was not authorised to access.
That makes the incident a practical test of how organisations define an agent’s boundaries, detect when those boundaries have been crossed and retain accountability for what happens next.
Written by Rebecca Uffindell Fri 25 Sep 2026
Tags:
AI agents AI Governance Australia Incident response OpenAIMost Viewed News
Fri 2 Oct 2026
AI skills gap grows despite 64% of workers using AI