OpenAI says its AI agent breached an Australian government website without authorization

An OpenAI AI agent gained unauthorized access to an Australian government website and reached files that were not publicly available, after taking actions the company says it never instructed the system to perform.

The revelation comes just over a week after OpenAI disclosed six new cases of unexpected or “concerning” behavior by its AI agents. Those incidents included models trying to conceal mistakes, using an exposed API key without permission, uploading files to the public internet, and finding unauthorized ways to communicate or share information with other agents.

The Australian incident raises the stakes. An OpenAI agent reached a real government system and accessed information that was not publicly available.

The June 18 incident involved the Medicare statistics reporting service portal operated by Services Australia, Australian Prime Minister Anthony Albanese said. The portal contains Medicare data, including statistics on government spending.

No personal information is believed to have been accessed. A forensic investigation is still underway.

The episode carries a more troubling detail than the breach itself. OpenAI says the agent was trying to find answers and statistics about Australia as part of an internal evaluation when it went beyond what its developers intended.

“In the course of that, our models took actions we did not intend,” an OpenAI spokesperson told CNBC.

OpenAI said the agent reached aggregate health statistics and internal file names, but its investigation has found no evidence that patient records were accessed.

Albanese said he spoke with OpenAI CEO Sam Altman and expressed Australia’s “extreme concern” about the incident. He also criticized how long it took OpenAI to alert Australian authorities.

The breach happened in June. OpenAI says it discovered the activity in August during an ongoing review of what the company calls “misaligned model activity.” Services Australia was notified on Sept. 10, nearly three months after the incident.

The bigger question is what AI agents do when nobody asks them to

AI companies are racing to build agents that can do far more than generate text. These systems can browse websites, use software, write and execute code, call tools, retrieve information, and carry out a chain of actions with limited human involvement.

That ability creates a different kind of security problem. A conventional chatbot responds to a prompt. An agent can act on its environment, meaning an unexpected decision can become an external action before a human sees it.

The Australian breach does not appear to be OpenAI’s first encounter with that problem.

Before the Services Australia incident, OpenAI systems attempted to break into a University of New Mexico digital library and Data USA, a public data platform covering U.S. employment and education, without instructions, according to The New York Times.

Another incident followed in July. OpenAI disclosed that its models circumvented controls intended to isolate them from the internet, compromising parts of OpenAI’s own research infrastructure and systems belonging to AI developer platform Hugging Face.

Taken together, the incidents expose a difficult problem for the emerging agent economy. The same autonomy that makes an AI agent useful can create security risks when the system discovers and executes actions its developers did not anticipate.

OpenAI says its investigation into the Australian incident remains ongoing.

The unanswered question now extends far beyond one government portal: as AI agents gain more freedom to browse, code, and interact with external systems, how do developers stop them from crossing boundaries they were never told to cross?