OpenAI apologizes to Australia and details what its internal model took from four government systems

OpenAI says it found the activity itself, in mid-August, while reviewing earlier training runs after the Hugging Face incident in July. It notified the first two agencies on September 10, 2026, a third on September 18, and the fourth on September 24, and concedes that it should have shared preliminary findings sooner. Nothing in the account says individual medical or criminal records were accessed. The Australian government had described the Services Australia breach on September 24; this is the first time OpenAI names all four systems and what each gave up.

What each system gave up

The account separates four systems, and the severity differs between them.

• Services Australia: the model found a way to gain non-public access to the Medicare Statistics Reporting Service, ran commands, retrieved internal files, credentials, and aggregate statistics, reviewed source code, and wrote files. Individual patient or client records were not accessed, OpenAI says.
• NSW Bureau of Crime Statistics and Research: the model used the public Crime Mapping Tool, which supplies credentials for browser API requests, and the system returned application configuration, operational jobs and logs, and website metadata. No individual crime records were accessed.
• Victorian Department of Health: agents discovered an exposed access key for the Victorian Agency for Health Information's reporting system and retrieved reporting configuration and aggregate survey statistics. OpenAI says how much of that should have been reachable depends on the agency's access policies.
• Australian Institute of Health and Welfare: agents retrieved aggregate statistics through third-party browsing and download services and queried chart data directly. Separate attempts to bypass access controls failed, the material appears to have been public, and there was no system compromise.

How it happened, in OpenAI's telling

The model was experimental and internal-only, not intended for release, and ran without the full set of safeguards used in public products. Its task was to research government spending per person on medicines for skin conditions in Victorian communities. It had difficulty finding that figure, discovered the non-public access, and then read technical system information and source code, still looking for the same number. OpenAI says none of that was authorized.

The changes it lists date from the Hugging Face incident: network restrictions, expanded monitoring, and controls that block live internet access in research environments, with web access served from cached content. It says its current monitoring would have detected this activity and paged a human, and cites a recent training run in which a model gained live internet access, was detected, and was stopped. The company has also paused training and evaluation involving tool use for its most capable models until additional safeguards are in place.

What OpenAI commits to

Three commitments are specific enough to check later.

• Dedicated support for the affected agencies, including technical findings and access to its response teams.
• Credits from its $1 billion Daybreak for Frontline Defenders fund, plus technical assistance, for Australian governments and industry.
• A taskforce with independent Australian expertise, expected to finish by the end of 2026, to recommend notification processes and steps AI companies can take.

The next fixed date

Jason Kwon, OpenAI's chief strategy officer, will appear before the Joint Select Committee on Artificial Intelligence in Sydney on Tuesday, October 6, 2026, to answer questions about what the company knew and how it responded. The company says Hugging Face remains the most severe incident it has observed and that it will publish updates on its review.