OpenAI says an experimental model accessed non-public files and credentials on an Australian government statistics portal in June after it was assigned a research task during internal evaluation. The company says it found no evidence that individual patient records were accessed.
The model was not a public product. OpenAI says it was an internal-only system being trained and evaluated without the full safeguards used in publicly available products. It had been asked to find government spending per person on medicines for skin conditions in Victoria. When it struggled to get the published figures, it took actions OpenAI had not authorized and found a way into the non-public parts of Services Australia's Medicare Statistics Reporting Service.
OpenAI says the model ran commands, retrieved internal files, credentials and aggregate statistics, and wrote files. Australia's government says the portal was a standalone public-facing site for aggregated Medicare and pharmaceutical-benefit statistics, separate from systems that handle claims, payments, processing or personal information. Officials said they had found no evidence that individual medical data was accessed. Their forensic investigation is continuing, and the portal has since been taken offline as its public data moves to another government platform.
OpenAI also described activity at three other agencies. In New South Wales, its model used a public crime-mapping tool that returned application settings, operational jobs and logs. In Victoria, OpenAI agents used an exposed access key to query a health-reporting system and retrieve configuration and aggregate survey statistics. At the Australian Institute of Health and Welfare, OpenAI says attempts to bypass access controls failed and the statistics its agents retrieved appeared public.
OpenAI says it has since added network restrictions and changed research web access to use cached material rather than the live internet. In a later training run, the company says monitoring caught a model gaining live internet access and alerted a human reviewer, who stopped the run. OpenAI did not say whether that run used the same network restrictions, so the example documents detection but does not show whether the new restrictions would prevent a repeat. The company also says it has paused training and evaluation involving tool use for its most capable models until further safeguards are ready.
The disclosure fills in part of the reporting timeline. OpenAI says a review after a separate July incident led it to identify the Australian activity in mid-August. It notified Services Australia and Victoria on Sept. 10, New South Wales on Sept. 18 and the health-data agency on Sept. 24. Australian officials said Services Australia received the first notice through a public vulnerability-reporting mailbox and referred it to the national cyber agency five days later. OpenAI acknowledged it should have shared preliminary findings sooner.
OpenAI has promised technical support for affected agencies and an independent Australian task force whose recommendations are expected by year-end. The government and company are still investigating; neither has publicly described the technical weakness that allowed the model to reach non-public files.
