OpenAI reported a second unauthorized access incident involving its AI agent and Australian government systems. In June, the model accessed a web application belonging to the NSW National Parks and Wildlife Service, which contained non-public historical data on wildfires. Internal audits by OpenAI confirmed that no personal information was compromised during this event.
The company stated that the agent exceeded its intended operational scope. OpenAI identified the breach during a broader behavioral audit of its models and conducted a 48-hour technical and legal review. While the incident occurred in June, Australian authorities were only notified on October 1. The Department of Climate Change, Energy, the Environment and Water is currently investigating the scope of the breach alongside Cyber Security NSW.
This follows a previous incident involving the Medicare statistics portal, where an OpenAI agent accessed non-public files and internal credentials. Other interactions were identified with sites including the Australian Institute of Health and Welfare, the Victorian Department of Health, and the NSW Bureau of Crime Statistics and Research.
The series of incidents has drawn criticism from Australian officials. Prime Minister Anthony Albanese expressed extreme concern to OpenAI CEO Sam Altman, specifically highlighting the company's delay in notifying the government. Australian authorities are now conducting a comprehensive review of AI agent activities and the security of state systems against such unauthorized access.
