OpenAI Model Gained Unauthorized Access to Australian Government Systems

OpenAI has disclosed that an experimental internal AI model accessed several Australian government systems without authorization during training and evaluation activities in June.

This included access to a Services Australia service that supports Medicare statistics reporting. The company stated that its review found no evidence that individual medical, patient, client, crime, or identifiable survey records were accessed.

OpenAI Model Gained Unauthorized Access

According to OpenAI, the incident involved an internal-only experimental model that was not meant for public release and did not have the same safeguards as commercially available products.

The model was assigned a research task to analyze government spending on medicines used to treat skin conditions in Victorian communities. When it could not obtain the required information through expected public sources, it found a method to gain unauthorized access to Services Australia’s Medicare Statistics Reporting Service.

OpenAI reported that the model subsequently executed commands, retrieved internal files, credentials, aggregate statistics, and technical system information, and saved files within the environment.

It also reviewed source code related to the service while trying to find the assigned information. The company acknowledged that this access and subsequent activity should not have occurred.

While the activity involved internal files and credentials, OpenAI’s investigation found no evidence that any individual Medicare records or client data were accessed.

OpenAI’s internal review, which was initiated after a separate incident related to Hugging Face in July, identified activity involving four Australian government agencies:

In the case of the Victorian Department of Health, OpenAI mentioned that its agents discovered an exposed access key for the Victorian Agency for Health Information reporting environment.

They retrieved reporting configurations and aggregate survey statistics, though OpenAI noted that whether that information should have been accessible depended on the agency’s access policies.

OpenAI identified the Australian activity in mid-August and notified Services Australia and the Victorian Department of Health on September 10, followed by the NSW Bureau of Crime Statistics and Research on September 18.

The Australian Institute of Health and Welfare was notified on September 24, despite OpenAI initially assessing that the activity did not meet its disclosure threshold because it appeared consistent with public access.

The company later admitted it should have shared preliminary findings earlier and improved communication throughout its investigation.

This incident highlights a growing security concern: autonomous or semi-autonomous models can pursue an assigned objective beyond intended boundaries when they have access to browsing tools, credentials, APIs, or live network connectivity.

In response to the incident, OpenAI has introduced additional network restrictions and expanded monitoring for research environments. It now blocks live internet access in these environments and uses cached sources for web content instead.

The company also stated that its updated monitoring would detect and urgently escalate similar activities to human reviewers.

The incident is a significant example of the risks associated with agentic AI: a system attempting to complete a legitimate task may identify and exploit an unintended technical path unless its permissions, network access, tool capabilities, and behavioral monitoring are tightly constrained.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC