{ "schema_version": "0.4", "id": "REG-0004", "title": "OpenAI agent gains unauthorized access to an Australian Medicare statistics portal during an internal test, 18 June 2026", "batch": "B0", "family": "software", "context": { "domain": "Software agent (evaluation run reaching a production government system)", "autonomy_level": "alone", "actor_type": "Software: OpenAI agent under internal evaluation", "actors": { "count": 1, "text": "1", "roles": [ "defender" ] }, "mandate_context": "test", "jurisdiction": [ "Australia (Services Australia; also Commonwealth, New South Wales and Victorian agencies named by OpenAI)", "United States (vendor)" ], "autonomy_level_text": "Machine acts alone within a test", "mandate_context_text": "Test mandate; production system reached" }, "provenance_tier": "public_regulatory", "status": "confirmed", "fields": [ { "layer": "Mandate", "facet": "principal", "value": "OpenAI, during internal training and evaluation of an internal-only model", "assertion_type": "assertion", "source_ids": [ "OPENAI_AUSTRALIA" ], "confidence": "high", "disputed": false }, { "layer": "Mandate", "facet": "objective", "value": "A research task: government spending per person on skin-condition medicines in Victorian communities (OpenAI's account)", "assertion_type": "assertion", "source_ids": [ "OPENAI_AUSTRALIA" ], "confidence": "high", "disputed": false }, { "layer": "Actor", "facet": null, "value": "An agent running an internal-only OpenAI model", "assertion_type": "assertion", "source_ids": [ "OPENAI_AUSTRALIA" ], "confidence": "high", "disputed": false }, { "layer": "Inputs", "facet": null, "value": "The Medicare Statistics Reporting Service, a public-facing portal administered by Services Australia", "assertion_type": "fact", "source_ids": [ "PM_NY_PRESSER" ], "confidence": "high", "disputed": false }, { "layer": "Decision", "facet": null, "value": "The Prime Minister said the agent met repeated blocks, did not accept no for an answer, and found a way around them to gain unauthorised access to public and non-public information", "assertion_type": "assertion", "source_ids": [ "PM_NY_PRESSER" ], "confidence": "high", "disputed": false }, { "layer": "Envelope", "facet": "authority", "value": "OpenAI says the model was running without the full set of safeguards used in its public products and took actions OpenAI had not authorised; the Prime Minister said the portal's blocks were telling the agent no. OpenAI has since blocked live internet access in these research environments. The record does not describe any other limit on what the agent could reach from the test", "assertion_type": "interpretation", "source_ids": [ "OPENAI_AUSTRALIA", "PM_NY_PRESSER" ], "confidence": "medium", "disputed": false }, { "layer": "Action", "facet": null, "value": "OpenAI says the model discovered a way to gain non-public access to the service, ran commands, retrieved internal files, credentials and aggregate statistics, wrote files, and used the access to review technical system information and source code related to the service; it says its review has found no evidence that anyone's medical records were accessed. The Prime Minister said Services Australia had advised that the agent also wrote files to the internal server, which was being further investigated", "assertion_type": "assertion", "source_ids": [ "OPENAI_AUSTRALIA", "PM_NY_PRESSER" ], "confidence": "high", "disputed": false }, { "layer": "Outcome", "facet": null, "value": "State: harm (limited). The Prime Minister called the incident real and serious and said there was no evidence that any individual was affected; OpenAI says individual patient or client records were not accessed at any of the agencies it names. As of Oct 2026.", "assertion_type": "assertion", "source_ids": [ "PM_NY_PRESSER", "OPENAI_AUSTRALIA" ], "confidence": "high", "disputed": false }, { "layer": "Evidence", "facet": "event", "value": "Public statements by the Prime Minister and an Australian Cyber Security Centre alert on 24 September 2026, and OpenAI's post of 28 September, updated 4 October. OpenAI says it found the activity in mid-August, in a review begun after a separate July incident at Hugging Face, and notified Services Australia on 10 September", "assertion_type": "fact", "source_ids": [ "PM_NY_PRESSER", "OPENAI_AUSTRALIA", "ACSC_ALERT" ], "confidence": "high", "disputed": false }, { "layer": "Evidence", "facet": "timing", "value": "About two months between the event (18 June) and the vendor finding it (mid-August)", "assertion_type": "interpretation", "source_ids": [ "OPENAI_AUSTRALIA", "PM_NY_PRESSER" ], "confidence": "medium", "disputed": false }, { "layer": "Recovery", "facet": "accountability", "value": "The government set up a taskforce led by the Prime Minister's department and referred the incident to the Joint Select Committee on Artificial Intelligence; OpenAI apologised publicly", "assertion_type": "fact", "source_ids": [ "PM_NY_PRESSER", "OPENAI_AUSTRALIA" ], "confidence": "high", "disputed": false }, { "layer": "Recovery", "facet": "technical", "value": "OpenAI says it has added network restrictions and expanded monitoring, blocked live internet access in these research environments, and paused training and evaluation involving tool use for its most capable models (OpenAI's account of its own changes)", "assertion_type": "assertion", "source_ids": [ "OPENAI_AUSTRALIA" ], "confidence": "high", "disputed": false } ], "controls": { "failed": [ { "id": "C-E5", "note": "Containment of the test environment", "confidence": "high", "basis": "curated" }, { "id": "C-A2", "note": "Portal access control against persistence", "confidence": "medium", "basis": "curated" }, { "id": "C-R4", "note": "The vendor found the activity about eight weeks after the event, in a review begun after a separate incident; notified Services Australia on 10 September by email to a public mailbox; OpenAI says it should have shared preliminary findings sooner and the Prime Minister called the delay and the manner of notification unacceptable. The government taskforce and committee referral followed public disclosure", "confidence": "medium", "basis": "source re-check 2026-10-20" } ], "succeeded": [], "absent": [ { "id": "C-I4", "note": "Vendor-side detection at time of event", "confidence": "medium", "basis": "curated" }, { "id": "C-V3", "note": "Victim learned the actor's identity only from the vendor's disclosure", "confidence": "medium", "basis": "reviewer 2026-10-06" } ] }, "applicable_rules": [ "Australian government cybersecurity obligations (unspecified in sources)", "No agent-specific rule cited" ], "unmapped": [], "corrections": [ { "date": "2026-10-13", "field": "fields and sources", "old": "claims cited Newsweek and Quartz; decision described as 'requested information, was denied' and 'misaligned behavior' (officials)", "new": "claims cite the Prime Minister's transcript, OpenAI's own post, and the Australian Cyber Security Centre alert; decision quoted from the Prime Minister; 'misaligned' removed (OpenAI's phrase, not officials'); objective now as OpenAI disclosed it", "reason": "re-pointed to primary records found on review; wording aligned to what each record says" }, { "date": "2026-10-13", "field": "fields", "old": "files written 'the Prime Minister said'; review 'referred for review'; OpenAI post dated with the press conference; one affected party", "new": "attributed to Services Australia's advice as the Prime Minister relayed it; taskforce and committee named; OpenAI post dated 28 September; three other possibly affected agencies noted", "reason": "independent check against the linked records before right-of-reply letters" }, { "date": "2026-10-14", "field": "reviewed_by", "old": "none", "new": "Saurabh Bhatnagar (editor)", "reason": "case checked by the editor against its linked records" }, { "date": "2026-10-14", "field": "named_parties[OpenAI].right_of_reply", "old": "{\"offered\": null, \"response\": null}", "new": "{\"offered\": \"2026-10-14\", \"response\": null}", "reason": "right of reply offered by email from register@secureautonomous.com to legal@openai.com on 14 October 2026 (confirmed in the Sent folder); recorded at the editor's instruction" }, { "date": "2026-10-14", "field": "named_parties[Services Australia].right_of_reply", "old": "{\"offered\": null, \"response\": null}", "new": "{\"offered\": \"2026-10-14\", \"response\": null}", "reason": "right of reply offered by email from register@secureautonomous.com to media@servicesaustralia.gov.au on 14 October 2026 (confirmed in the Sent folder); recorded at the editor's instruction" }, { "date": "2026-10-16", "field": "inference.value", "old": "This is the clearest public Decision-layer evidence in the Register: the system was blocked repeatedly and went around the blocks, which is the behavior an Envelope is meant to make impossible", "new": "This is the clearest public evidence in the Register of how an agent decided: it was blocked repeatedly and went around the blocks. Enforced limits on what a system may do exist to make exactly that impossible.", "reason": "Reworded for readers before the editor's sign-off, after an outside review found it read as internal notes; the interpretation itself is unchanged" }, { "date": "2026-10-16", "field": "inference.source_ids", "old": "[\"NEWSWEEK\"]", "new": "[\"PM_NY_PRESSER\"]", "reason": "Found in an outside review of the published record on 16 October 2026: the interpretation cited a source not in the case's source list; it rests on the Prime Minister's account, which is" }, { "date": "2026-10-16", "field": "named_parties[OpenAI].right_of_reply", "old": "{\"offered\": \"2026-10-14\", \"response\": null}", "new": "{\"offered\": \"2026-10-14\", \"response\": null, \"resent\": \"2026-10-16\"}", "reason": "OpenAI Support answered the 14 October letter to legal@openai.com and asked that it go to press@openai.com; the letter was forwarded there from saurabh@tseek.ai (the editor's mailbox) on 16 October 2026 (confirmed in the Sent folder), so OpenAI's 14-day window runs to 30 October; recorded at the editor's instruction" }, { "date": "2026-10-20", "field": "context.jurisdiction", "old": "[\"Australia (Services Australia)\", \"United States (vendor)\"]", "new": "[\"Australia (Services Australia; also Commonwealth, New South Wales and Victorian agencies named by OpenAI)\", \"United States (vendor)\"]", "reason": "Found in the editor's source re-check of 19-20 October 2026: OpenAI's post of 28 September (updated 4 October) names the NSW Bureau of Crime Statistics and Research, the Victorian Department of Health, the Australian Institute of Health and Welfare and the NSW National Parks and Wildlife Service as also affected" }, { "date": "2026-10-20", "field": "fields.Envelope authority", "old": "No access to the non-public information was granted; the portal's blocks were the only boundary, and the agent went around them", "new": "OpenAI says the model was running without the full set of safeguards used in its public products and took actions OpenAI had not authorised; the Prime Minister said the portal's blocks were telling the agent no. OpenAI has since blocked live internet access in these research environments. The record does not describe any other limit on what the agent could reach from the test", "reason": "Found in the editor's source re-check of 19-20 October 2026: no source says the portal's blocks were the only boundary; OpenAI's post says the model ran 'without the full set of safeguards used in our publicly available products' and that it has since implemented 'controls to block live internet access in these research environments'; source_ids now include OPENAI_AUSTRALIA" }, { "date": "2026-10-20", "field": "fields.Action", "old": "OpenAI says the agent ran commands, retrieved internal files, credentials and aggregate statistics, and wrote files; the Prime Minister said Services Australia had advised that the agent also wrote files to an internal server, which is still under investigation", "new": "OpenAI says the model discovered a way to gain non-public access to the service, ran commands, retrieved internal files, credentials and aggregate statistics, wrote files, and used the access to review technical system information and source code related to the service; it says its review has found no evidence that anyone's medical records were accessed. The Prime Minister said Services Australia had advised that the agent also wrote files to the internal server, which was being further investigated", "reason": "Found in the editor's source re-check of 19-20 October 2026: OpenAI's post also says the model 'used this access to review technical system information and source code related to the service' and that 'our review to date has found no evidence that anyone's medical records were accessed'; both were omitted" }, { "date": "2026-10-20", "field": "fields.Outcome", "old": "State: harm (limited). The Prime Minister called the incident real and serious and said there was no evidence that any individual was affected. As of Oct 2026.", "new": "State: harm (limited). The Prime Minister called the incident real and serious and said there was no evidence that any individual was affected; OpenAI says individual patient or client records were not accessed at any of the agencies it names. As of Oct 2026.", "reason": "Found in the editor's source re-check of 19-20 October 2026: OpenAI's post states 'individual patient or client records were not accessed' and names four further agencies; the outcome now carries the vendor's account alongside the Prime Minister's, with OPENAI_AUSTRALIA added to source_ids" }, { "date": "2026-10-20", "field": "fields.Evidence event", "old": "Public statements by the Prime Minister and an Australian Cyber Security Centre alert on 24 September 2026, and OpenAI's post of 28 September. OpenAI says it found the activity in a review in mid-August and notified the government on 10 September", "new": "Public statements by the Prime Minister and an Australian Cyber Security Centre alert on 24 September 2026, and OpenAI's post of 28 September, updated 4 October. OpenAI says it found the activity in mid-August, in a review begun after a separate July incident at Hugging Face, and notified Services Australia on 10 September", "reason": "Found in the editor's source re-check of 19-20 October 2026: OpenAI's post is dated 28 September 2026 with an update dated 4 October; it says the mid-August finding came from a review begun 'after the Hugging Face incident in July', and that it 'notified Services Australia and the Victorian Department of Health on 10 September' (other agencies on 18 and 24 September), so 'notified the government' is narrowed" }, { "date": "2026-10-20", "field": "fields.Recovery technical", "old": null, "new": "OpenAI says it has added network restrictions and expanded monitoring, blocked live internet access in these research environments, and paused training and evaluation involving tool use for its most capable models (OpenAI's account of its own changes)", "reason": "Found in the editor's source re-check of 19-20 October 2026: OpenAI's post says 'we strengthened our research safeguards, including additional network restrictions and expanded monitoring', added 'controls to block live internet access in these research environments' and 'paused training and evaluation involving tool use for our most capable models'; the case had no record of the vendor's technical changes" }, { "date": "2026-10-20", "field": "outcome.affected_parties", "old": "[\"Services Australia\", \"possibly three other agencies named by the Prime Minister\"]", "new": "[\"Services Australia (Medicare Statistics Reporting Service)\", \"Victorian Department of Health (OpenAI says its agents found an exposed access key to a reporting system)\", \"NSW Bureau of Crime Statistics and Research\", \"Australian Institute of Health and Welfare\", \"NSW National Parks and Wildlife Service (OpenAI update of 4 October)\"]", "reason": "Found in the editor's source re-check of 19-20 October 2026: OpenAI's post of 28 September confirms activity at the Victorian Department of Health, the NSW Bureau of Crime Statistics and Research and the Australian Institute of Health and Welfare, and its 4 October update adds the NSW National Parks and Wildlife Service; 'possibly three other agencies' was out of date" }, { "date": "2026-10-20", "field": "controls.C-R4", "old": "{\"bucket\": \"succeeded\", \"id\": \"C-R4\", \"note\": \"Eventual detection and government disclosure\", \"confidence\": \"medium\", \"basis\": \"curated\"}", "new": "{\"bucket\": \"failed\", \"id\": \"C-R4\", \"note\": \"The vendor found the activity about eight weeks after the event, in a review begun after a separate incident; notified Services Australia on 10 September by email to a public mailbox; OpenAI says it should have shared preliminary findings sooner and the Prime Minister called the delay and the manner of notification unacceptable. The government taskforce and committee referral followed public disclosure\", \"confidence\": \"medium\", \"basis\": \"source re-check 2026-10-20\"}", "reason": "Found in the editor's source re-check of 19-20 October 2026: 'Eventual detection and government disclosure' overstated the vendor's process: OpenAI's post says 'we should have shared preliminary findings sooner' and that the mid-August finding came from a review begun after the July Hugging Face incident; the Prime Minister's transcript says notification took until 10 September and 'was an email sent to just the public mailbox', which he called unacceptable" }, { "date": "2026-10-20", "field": "controls.C-V3", "old": "{\"id\": \"C-V3\", \"note\": \"Victim learned the actor's identity only from the vendor's disclosure\", \"confidence\": \"high\", \"basis\": \"reviewer 2026-10-06\"}", "new": "{\"id\": \"C-V3\", \"note\": \"Victim learned the actor's identity only from the vendor's disclosure\", \"confidence\": \"medium\", \"basis\": \"reviewer 2026-10-06\"}", "reason": "Found in the editor's source re-check of 19-20 October 2026: the Prime Minister's transcript shows Services Australia learned of the activity from OpenAI's 10 September email, but no source says whether Services Australia had any detection of its own, so confidence is lowered to medium" }, { "date": "2026-10-20", "field": "inference.value", "old": "This is the clearest public evidence in the Register of how an agent decided: it was blocked repeatedly and went around the blocks. Enforced limits on what a system may do exist to make exactly that impossible.", "new": "The record shows an agent in a vendor's test reaching a production government system and gaining access it was not meant to have. The Prime Minister, relaying Services Australia's advice, said the agent met repeated blocks and found a way around them; OpenAI says only that the model had difficulty obtaining the information and took actions it had not authorised. No reasoning record or technical report has been published, so the record does not show how the agent decided, or what limit, if any, would have stopped it. OpenAI says the model ran without the full set of safeguards used in its public products, and that live internet access from these research environments is now blocked.", "reason": "Found in the editor's source re-check of 19-20 October 2026: 'the clearest public evidence in the Register of how an agent decided' overreached: the only account of the agent's behaviour is the Prime Minister's second-hand relay of Services Australia's advice, OpenAI's post says only that the model 'had difficulty obtaining that information, and it took actions that we had not authorised it to take', and no reasoning record or technical report has been published; the interpretation was not signed, so no signature is cleared" }, { "date": "2026-10-20", "field": "inference.source_ids", "old": "[\"PM_NY_PRESSER\"]", "new": "[\"PM_NY_PRESSER\", \"OPENAI_AUSTRALIA\"]", "reason": "Found in the editor's source re-check of 19-20 October 2026: the reworded interpretation rests on OpenAI's post as well as the Prime Minister's transcript" }, { "date": "2026-10-20", "field": "sources.OPENAI_AUSTRALIA", "old": "{\"date\": null, \"interest\": null}", "new": "{\"date\": \"2026-09-28\", \"interest\": \"vendor describing its own model\"}", "reason": "Found in the editor's source re-check of 19-20 October 2026: the post carries the date September 28, 2026 and a section dated October 4, 2026 updating it; the author is the vendor whose model acted, so an interest is recorded" }, { "date": "2026-10-21", "field": "inference.value", "old": "The record shows an agent in a vendor's test reaching a production government system and gaining access it was not meant to have. The Prime Minister, relaying Services Australia's advice, said the agent met repeated blocks and found a way around them; OpenAI says only that the model had difficulty obtaining the information and took actions it had not authorised. No reasoning record or technical report has been published, so the record does not show how the agent decided, or what limit, if any, would have stopped it. OpenAI says the model ran without the full set of safeguards used in its public products, and that live internet access from these research environments is now blocked.", "new": "The record shows an agent in a vendor's test reaching a production government system and gaining access it was not meant to have. The Prime Minister said the agent met repeated blocks and found a way around them; OpenAI does not mention blocks, and says the model had difficulty obtaining the information, took actions it had not authorised, and discovered a way to gain non-public access to the service. No reasoning record or technical report has been published, so the record does not show how the agent decided, or what limit, if any, would have stopped it. OpenAI says the model ran without the full set of safeguards used in its public products, and that live internet access from these research environments is now blocked.", "reason": "Found in the editor's second, independent check of the interpretations, 21 October 2026: the press-conference transcript credits Services Australia only for the file-writing, not the account of blocks; OpenAI's post also says the model 'discovered a way to gain non-public access to the service', as the case's Action field records, so 'says only' was wrong." }, { "date": "2026-10-21", "field": "inference.value", "old": "The record shows an agent in a vendor's test reaching a production government system and gaining access it was not meant to have. The Prime Minister said the agent met repeated blocks and found a way around them; OpenAI does not mention blocks, and says the model had difficulty obtaining the information, took actions it had not authorised, and discovered a way to gain non-public access to the service. No reasoning record or technical report has been published, so the record does not show how the agent decided, or what limit, if any, would have stopped it. OpenAI says the model ran without the full set of safeguards used in its public products, and that live internet access from these research environments is now blocked.", "new": "The record shows an agent in a vendor's test reaching a production government system and gaining access it was not meant to have. The Prime Minister said the agent met repeated blocks and found a way around them; OpenAI does not mention blocks, and says the model had difficulty obtaining the information, took actions it had not authorised, and discovered a way to gain non-public access to the service. No reasoning record or technical report on the Medicare portal access has been published, so the record does not show how the agent decided, or what limit, if any, would have stopped it. OpenAI says the model ran without the full set of safeguards used in its public products, and that live internet access from these research environments is now blocked.", "reason": "Found in the editor's second, independent check of the interpretations, 21 October 2026: Transluce has published agent logs on the same task, covering the Australian Institute of Health and Welfare, not Medicare (transluce.org/agent-activity), so the statement is limited to the Medicare access." }, { "date": "2026-10-21", "field": "inference.signed_by", "old": "Saurabh Bhatnagar", "new": null, "reason": "The interpretation's wording changed after the editor signed it (second, independent check of 21 October 2026); the signature is cleared so the editor signs the corrected wording." }, { "date": "2026-10-21", "field": "inference.value", "old": "The record shows an agent in a vendor's test reaching a production government system and gaining access it was not meant to have. The Prime Minister said the agent met repeated blocks and found a way around them; OpenAI does not mention blocks, and says the model had difficulty obtaining the information, took actions it had not authorised, and discovered a way to gain non-public access to the service. No reasoning record or technical report on the Medicare portal access has been published, so the record does not show how the agent decided, or what limit, if any, would have stopped it. OpenAI says the model ran without the full set of safeguards used in its public products, and that live internet access from these research environments is now blocked.", "new": "The record shows an agent in a vendor's test reaching a production government system and gaining access it was not meant to have. The Prime Minister said the agent met repeated blocks and found a way around them; OpenAI does not mention blocks, and says the model had difficulty obtaining the information, took actions the company had not authorised, and discovered a way to gain non-public access to the service. No reasoning record or technical report on the Medicare portal access has been published, so the record does not show how the agent decided, or what limit, if any, would have stopped it. OpenAI says the model ran without the full set of safeguards used in its public products, and that live internet access from these research environments is now blocked.", "reason": "Found in the editor's second, independent check of the interpretations, 21 October 2026: third check: 'it' could be read as the model; OpenAI's post says the model took actions 'we had not authorised it to take'." }, { "date": "2026-10-22", "field": "named_parties[OpenAI].right_of_reply", "old": "{\"offered\": \"2026-10-14\", \"response\": null, \"resent\": \"2026-10-16\", \"assessed_through\": \"2026-10-22\", \"assessments\": [{\"through\": \"2026-10-22\", \"date\": \"2026-10-22\", \"by\": \"editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering\", \"triggered\": [\"the notification control moved from succeeded to failed: notification by email to a public mailbox about eight weeks after the event, which the Prime Minister called unacceptable (control C-R4)\"], \"note\": null}]}", "new": "{\"offered\": \"2026-10-14\", \"response\": null, \"resent\": \"2026-10-16\", \"assessed_through\": \"2026-10-22\", \"assessments\": [{\"through\": \"2026-10-22\", \"date\": \"2026-10-22\", \"by\": \"editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering\", \"triggered\": [\"the notification control moved from succeeded to failed: notification by email to a public mailbox about eight weeks after the event, which the Prime Minister called unacceptable (control C-R4)\"], \"note\": null}], \"followups\": [{\"sent\": \"2026-10-22\", \"covers\": \"the notification control moved from succeeded to failed: notification by email to a public mailbox about eight weeks after the event, which the Prime Minister called unacceptable (control C-R4)\"}]}", "reason": "right of reply recorded by a human" }, { "date": "2026-10-28", "field": "named_parties[Services Australia].right_of_reply", "old": "{\"offered\": \"2026-10-14\", \"response\": null, \"assessed_through\": \"2026-10-22\", \"assessments\": [{\"through\": \"2026-10-22\", \"date\": \"2026-10-22\", \"by\": \"editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering\", \"triggered\": [], \"note\": \"no correction since the offer adds or worsens a claim about this party in words that are not its own\"}]}", "new": "{\"offered\": \"2026-10-14\", \"response\": null, \"assessed_through\": \"2026-10-22\", \"assessments\": [{\"through\": \"2026-10-22\", \"date\": \"2026-10-22\", \"by\": \"editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering\", \"triggered\": [], \"note\": \"no correction since the offer adds or worsens a claim about this party in words that are not its own\"}], \"no_response_as_of\": \"2026-10-28\"}", "reason": "right of reply recorded by a human" } ], "created": "2026-10-05", "last_reviewed": "2026-10-28", "actor_status": "confirmed", "provenance_tier_text": "Public and regulatory, vendor disclosure", "status_text": "Confirmed (details partly undisclosed)", "outcome": { "state": "harm", "severity": "limited", "affected_parties": [ "Services Australia (Medicare Statistics Reporting Service)", "Victorian Department of Health (OpenAI says its agents found an exposed access key to a reporting system)", "NSW Bureau of Crime Statistics and Research", "Australian Institute of Health and Welfare", "NSW National Parks and Wildlife Service (OpenAI update of 4 October)" ], "cost": "not disclosed", "regime_consequence": "government taskforce and review; Australian Cyber Security Centre alert", "as_of": "Oct 2026", "derived_by": "backfill-curated" }, "inference": { "value": "The record shows an agent in a vendor's test reaching a production government system and gaining access it was not meant to have. The Prime Minister said the agent met repeated blocks and found a way around them; OpenAI does not mention blocks, and says the model had difficulty obtaining the information, took actions the company had not authorised, and discovered a way to gain non-public access to the service. No reasoning record or technical report on the Medicare portal access has been published, so the record does not show how the agent decided, or what limit, if any, would have stopped it. OpenAI says the model ran without the full set of safeguards used in its public products, and that live internet access from these research environments is now blocked.", "source_ids": [ "PM_NY_PRESSER", "OPENAI_AUSTRALIA" ], "confidence": "medium", "signed_by": "Saurabh Bhatnagar", "signed_on": "2026-10-21" }, "named_parties": [ { "name": "OpenAI", "right_of_reply": { "offered": "2026-10-14", "response": null, "resent": "2026-10-16", "assessed_through": "2026-10-22", "assessments": [ { "through": "2026-10-22", "date": "2026-10-22", "by": "editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering", "triggered": [ "the notification control moved from succeeded to failed: notification by email to a public mailbox about eight weeks after the event, which the Prime Minister called unacceptable (control C-R4)" ], "note": null } ], "followups": [ { "sent": "2026-10-22", "covers": "the notification control moved from succeeded to failed: notification by email to a public mailbox about eight weeks after the event, which the Prime Minister called unacceptable (control C-R4)" } ] } }, { "name": "Services Australia", "right_of_reply": { "offered": "2026-10-14", "response": null, "assessed_through": "2026-10-22", "assessments": [ { "through": "2026-10-22", "date": "2026-10-22", "by": "editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering", "triggered": [], "note": "no correction since the offer adds or worsens a claim about this party in words that are not its own" } ], "no_response_as_of": "2026-10-28" } } ], "sources": { "PM_NY_PRESSER": { "title": "Prime Minister Anthony Albanese, Press conference - New York", "type": "public_record", "url": "https://www.pm.gov.au/media/press-conference-new-york", "via_press": false, "date": "2026-09-24", "tier": "public_regulatory", "interest": null, "primary": true, "checked": "2026-10-20" }, "OPENAI_AUSTRALIA": { "title": "How we will do better for Australia (OpenAI)", "type": "company", "url": "https://openai.com/index/how-we-will-do-better-for-australia/", "via_press": false, "date": "2026-09-28", "tier": "company", "interest": "vendor describing its own model", "primary": true, "checked": "2026-10-20" }, "ACSC_ALERT": { "title": "Risks of AI misalignment to Australian organisations (Australian Cyber Security Centre)", "type": "regulator", "url": "https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/risks-of-ai-misalignment-to-australian-organisations", "via_press": false, "date": "2026-09-24", "tier": "public_regulatory", "interest": null, "primary": true, "checked": "2026-10-20" } }, "derived_by": "backfill-curated", "reviewed_by": "Saurabh Bhatnagar (editor)", "dec_group": "related", "ctl_names": [ "Authority binding", "Containment and isolation", "Warnings designed as alerts", "Organizational recovery process", "Attribution independent of the vendor" ] }