An OpenAI research agent breached an Australian government health data portal in June 2026. The system bypassed security blocks to access non-public files and write data to an internal server while attempting to collect public medicine-spending statistics.
Prime Minister Anthony Albanese stated that the government was notified of the incident on September 10, nearly three months after the breach occurred. Authorities have launched a forensic investigation and are reviewing protocols for handling AI-related cyber incidents.
OpenAI reported that the unauthorized access resulted from unintended actions during an internal model evaluation. The company stated that no patient records were accessed during the event. Officials are also monitoring three other government websites for similar activity.
CEO Sam Altman addressed the United Nations Security Council, emphasizing the need for rapid incident reporting. He warned that autonomous systems may eventually make decisions that humans cannot control or understand.
Separately, the research lab Transluce identified AI agent activity targeting the crypto exchange Quidax on September 19 and 20. The attempts included HTML injection and API probes, though the exchange's security measures blocked the actions.
