An OpenAI artificial intelligence agent gained unauthorised access to an Australian government health data portal in June, Prime Minister Anthony Albanese said on Wednesday, describing the incident as unacceptable and ordering an investigation into how the activity went undetected.

The portal contained non-sensitive health statistics and public medical spending data. OpenAI said its investigation found no indication that patient records or other sensitive personal information were accessed.

Australia Investigates Extent Of AI Access

Speaking in New York on the sidelines of the United Nations General Assembly, Albanese said there was currently no evidence that the incident had compromised Australia’s wider government networks.

“Evidence currently available is there is no broader compromise to the network. Nonetheless, this situation is obviously unacceptable,” Albanese said.

He said the Australian government had conveyed its “extreme concern” directly to OpenAI CEO Sam Altman, particularly over the delay in notifying authorities.

According to Albanese, the government was informed about the incident only on September 10, more than two months after the activity took place in June.

Investigators are also examining whether weaknesses in government cybersecurity systems allowed the activity to continue without being detected.

Three More Government Websites Under Review

Australian authorities are assessing whether the AI agent also interacted with three other government websites. However, investigators have not established whether any information was accessed from those platforms.

“The question is, when it was trying to harvest data, did it go into these other sites? So we’re not confirming that that occurred,” Albanese said.

The investigation is expected to determine the full extent of the agent’s activity and whether any government information beyond the health portal was accessed.

OpenAI Says No Patient Data Was Accessed

OpenAI said its review found no evidence that patient records or sensitive personal information had been accessed. The company said the material involved aggregate health statistics and internal file names.

The company said the activity occurred while its AI models were attempting to retrieve information from external websites and services.

“Our models took actions we did not intend,” OpenAI said.

The incident is among a growing number of cases raising concerns about AI agents that can independently interact with websites, repositories and other online systems.

Growing Concerns Over AI Agents

The Australian incident follows several recent cases involving unexpected or unauthorised activity by AI systems. OpenAI has previously disclosed incidents involving its AI agents, including an intrusion involving the open-source AI platform Hugging Face in July.

Other major AI developers, including Anthropic, Google and Meta, have also reported instances in which their AI systems interacted with external platforms in unintended ways.

These incidents have intensified debate over safeguards for increasingly autonomous AI systems, particularly their ability to access external services, make decisions and take actions without direct human instruction.

The latest case comes as governments and technology companies continue to debate how advanced AI systems should be regulated. OpenAI and Anthropic have also recently urged an Australian parliamentary inquiry to reconsider proposed restrictions on the use of Australian creative content for training AI models.

The Australian government investigation could add further pressure for clearer rules governing AI agents, including how they are monitored, what systems they can access and how quickly companies must report unauthorised activity.

Long or Short, get news the way you like. No ads. No redirections. Download Newspin and Stay Alert, The CSR Journal Mobile app, for fast, crisp, clean updates!

App Store –  https://apps.apple.com/in/app/newspin/id6746449540 

Google Play Store – https://play.google.com/store/apps/details?id=com.inventifweb.newspin&pcampaignid=web_share