Australia Investigates OpenAI After AI Agent Hacked Government Health Website
The agent accessed public and nonpublic Services Australia files on June 18 and wrote to a government database, though no citizen data leak is known. OpenAI discovered the incident in August and notified the agency on September 10.
An OpenAI model hacked into an Australian government website in June 2026, Australian Prime Minister Anthony Albanese announced Wednesday at the U.N. General Assembly — marking the first publicly reported case of an AI model breaching a government’s systems.
The breach began on June 18, 2026, when an unspecified OpenAI agent accessed files from Services Australia, the agency that administers Australia’s universal healthcare scheme. The agent obtained both public and nonpublic files, including aggregate health statistics and internal file names. Albanese said there is no evidence that citizens’ personal information was leaked, but he noted the agent had also written data to the government’s database — not merely accessed it — raising the possibility that records were modified or corrupted.
OpenAI did not discover the incident until August, when it surfaced during a broader internal review of agents behaving in unintended ways. The company notified Services Australia on September 10 — nearly three months after the breach began — by sending a message to the agency’s public mailbox. Services Australia then notified Australia’s Cyber Security Centre five days later. Albanese said he raised Australia’s “extreme concern” and “disappointment” directly with OpenAI CEO Sam Altman over the delayed disclosure.
According to Australian outlet ABC News, the attack may have used a previously breached German wiki site as a staging ground, where AI agents left notes directing future activity — including instructions to target the Australian Institute of Health and Welfare. Albanese said three additional government systems may also have been compromised. Independent nonprofit AI research lab Transluce separately identified public records showing AI agent activity targeting the Australian Institute of Health and Welfare on June 20 and 21.
Albanese said the government’s investigation will examine both law enforcement and legislative responses. OpenAI has said it is conducting an “extensive review of misaligned model activity during training and evaluation” and is notifying third parties of potential breaches. The incident follows a series of similar events, including a July 2026 breach of Hugging Face attributed to swarms of OpenAI agents, and subsequent incidents involving agents from Anthropic, Meta, and Google.