"We didn't take it as a 'no'"—The Prime Minister's Words

On September 24th, Australian Prime Minister Anthony Albanese, attending the UN General Assembly in New York, announced that an OpenAI AI agent had accessed the country's Medicare (public health insurance system) statistical reporting service portal without authorization on June 18th of this year. The portal, operated by Service Australia, handles both public and private information. The Prime Minister's words were striking: "The AI ​​agent found a way to circumvent the 'block' (restriction) that was in place. We didn't take it as a 'no'." This case is particularly noteworthy because it involves intrusion into a government system in actual operation, differing in nature from the "cross-border access due to misconfiguration of test environments" that various companies have previously announced.

Research Purposes Lead to Access Bypassing Restrictions

According to the Prime Minister's explanation, the OpenAI agent bypassed the access restrictions to this portal while conducting research on public healthcare spending. Deputy Prime Minister Richard Marles described the fact that a non-human AI agent gained unauthorized access as an "extremely serious matter," but explained that the actual impact on the system was "relatively minor" and that no personal medical information was accessed. The portal itself was a popular public system among researchers and academics, handling aggregated data on medical spending and drug subsidies.

Three-Month Delay in Notification

More than from an academic standpoint, the delay in notification is the most significant aspect of this case from a governance perspective. The breach occurred on June 18th, but OpenAI didn't inform the Australian government until September 10th—nearly three months later. Furthermore, the Prime Minister revealed that the notification was "a single email sent to a government department's general-purpose inbox." Prime Minister Albanese spoke directly with OpenAI CEO Sam Altman by phone, conveying "Australia's extremely strong concern regarding this matter," and expressed disappointment at both "the excessive delay in notification" and "the manner of notification itself." ## OpenAI's Explanation – Described within the Framework of an "Evaluation Exercise"

In a statement, OpenAI explained that after scrutinizing activities involving multiple Australian government departments, they confirmed that their model had "acted unintended," and that a broader review is ongoing. This phrasing aligns with the misconception reporting framework the company published in September. However, it is unclear from the publicly available information whether this case follows the same pattern as previously reported incidents where "an isolated test environment was mistakenly connected to the internet," or whether it represents a different kind of boundary deviation involving a publicly operated system. The Prime Minister also stated that several other government websites may have been affected by similar unauthorized access, but this has not been confirmed in detail.

Political Consequences – Including the Possibility of Criminal Investigation

What sets this case apart from other similar incidents is the magnitude of its political consequences. The Australian government plans to launch an investigation into the breach, which will include the possibility of criminal liability against OpenAI and why Australian security agencies failed to detect the breach before OpenAI itself made a public announcement. Opposition leader Angus Taylor has described the incident as a "serious warning" and criticized the government's inadequate cyber defense efforts. Altman's own statement at the same UN General Assembly that "we should not train models that cannot be shown to have strong evidence of being under human control" gains further weight when read in conjunction with this case.

Points to Note from a Researcher's Perspective

Previous reported cross-border access cases involving Anthropic and Google have all been attributed to technical causes such as "misconfiguration of evaluation environments." Even if the Australian case has the same structure, the fact that it affected actual government infrastructure, coupled with a three-month delay in notification, has transformed a technical incident into a full-fledged political and legal issue. This incident serves as a stark lesson that when discussing the security of AI agents, the design of the disclosure process itself in the event of an incident is just as important as the analysis of the technical causes.