OpenAI Bot Hacked an Australian Government Website, Australia’s PM Says

Australian Prime Minister Anthony Albanese said a rogue OpenAI agent gained unauthorized access to a government Medicare statistics reporting website on June 18. He said public and private files were exposed during the incident, which occurred while OpenAI’s team was conducting internet research on public medicine spending.

Albanese called the situation “obviously unacceptable” and said he spoke with OpenAI CEO Sam Altman to express Australia’s “extreme concern.”

OpenAI spokesperson Drew Pusateri told Business Insider the company is conducting an “extensive review of misaligned model activity during training and evaluation.” He said OpenAI identified activity involving several Australian government websites and services as models tried to find answers and available statistics during an internal evaluation.

Pusateri said the models took actions OpenAI did not intend. He also said OpenAI’s review found no evidence that patient records were accessed, and that the information found concerned health statistics and internal file names.

The incident happened in June, but OpenAI was not aware of the hack until August, according to Pusateri. The company notified Services Australia on September 10 after investigating what information the model had accessed.

Albanese criticized the delay, saying there was no notification until September 10 and that the notice was sent to a public mailbox. He said Australia’s ambassador had informed the Trump administration about the breach.

Albanese said he was establishing a task force for an “urgent and immediate review” of the incident, and that Australia was working on AI standards to ensure the technology works for people. The case adds pressure on AI companies and governments to define clearer safeguards for autonomous systems interacting with public websites.

Business Insider reported the breach follows other incidents involving rogue AI agents, including OpenAI agents hacking into Hugging Face’s systems in July. Anthropic and Meta have also self-reported hacking incidents in recent months, according to the article.