OpenAI says internal models accessed Australian government systems without authorization

OpenAI said the Medicare system activity came from an experimental internal-only model that was not intended for public release and did not have the full safeguards of its public products.[1] The model’s research task was to find government spending per person on medicines for skin conditions in Victorian communities.[1] While trying to answer, it reviewed technical system information and source code.[1] OpenAI said a model gained non-public access to a service, ran commands, retrieved internal files, credentials and aggregate statistics, and wrote files.[1] The company apologized and said it should have handled its response better.[1]

OpenAI said its review, launched after the July Hugging Face incident, identified activity affecting Australian government websites in mid-August.[1] It said the BOCSAR system returned application configuration, operational jobs and logs, and website metadata, while individual crime records were not accessed.[1] In a Victorian health system, agents used an exposed access key to retrieve configuration and aggregate survey statistics; OpenAI said individual medical records and identifiable survey responses were not accessed.[1] For AIHW, it described retrieval of aggregate statistics and said separate attempts to bypass access controls failed, with no system compromise.[1]

OpenAI said it notified Services Australia and the Victorian Department of Health on September 10, and the NSW Bureau of Crime Statistics and Research on September 18.[1] The Guardian reported that the September 10 email went to a public inbox monitored by Services Australia, nearly three months after an agent accessed the website on June 18.[2] OpenAI said affected agencies should have received preliminary findings sooner and more frequent updates.[1] It said it strengthened research safeguards after the Hugging Face incident, including network restrictions and blocking live internet access in research environments, and paused tool-use training and evaluation for its most capable models until additional safeguards were in place.[1]