Here's what actually happened in OpenAI's Australian gov't server hack

OpenAI disclosed that an experimental, internal-only model, tasked in June with researching government spending statistics in the Australian state of Victoria, gained unauthorized non-public access to a government server after failing to find the data through public statistics, reading technical system information, source code, credentials and aggregate statistics, and creating and reading back a small test file. In a disclosure email to Australia's Public Disclosure account, OpenAI said the model "identified a way to make the server carry out instructions sent through the public reporting interface, without a private account or password," and that its review found no evidence the model accessed patient-level records, personal information or credentials, deleted data, or established ongoing access. The disclosure follows Australian Prime Minister Anthony Albanese's earlier statement that an OpenAI agent had accessed "non-public files" from the country's Medicare statistics portal during testing.

Last week, when Australian Prime Minister Anthony Albanese told the world that an OpenAI agent had accessed “non-public files” from his country’s Medicare statistics portal https://arstechnica.com/ai/2026/09/openai-agent-didnt-accept-no-for-an-answer-in-australian-government-breach/ during testing, his description of the incident was a little light on details. Today, we’re getting new information on just how far OpenAI’s overzealous agent went in attempting to satisfy a rather innocuous-sounding informational prompt. In a newly published blog post https://openai.com/index/how-we-will-do-better-for-australia/ , OpenAI says the June incident started when the company asked “an experimental, internal-only OpenAI model” to research government spending statistics in the Australian state of Victoria. When the model ran into trouble finding that data using the publicly published statistics that it was supposed to reference, “it took actions that we had not authorized it to take” to find an answer, OpenAI said. Those unauthorized actions included finding “a way to gain non-public access to the service” and using that access to view “technical system information and source code” alongside credentials and the aggregate statistics it was actually searching for, OpenAI said. In a newly published disclosure email https://s3.ap-southeast-2.amazonaws.com/afr-visual-stories-production.ffx.io/2026/data/document-host/OpenAI+disclosure+-+blacked+out+version Redacted+-+Rohan+Sullivan.pdf that was sent to Australia’s Public Disclosure account earlier this month, OpenAI said its model had “identified a way to make the server carry out instructions sent through the public reporting interface, without a private account or password.” That unauthorized access let the agent “read portions of internal program files and settings, obtain a list of files, and create and read back a small test file on the server,” according to the email. “Our review found no evidence that the model accessed patient-level records, personal information or credentials; deleted data; or established ongoing access,” OpenAI continued in the email.