OpenAI has issued an apology for internal model training activities in June that resulted in unauthorized access to several Australian government websites, including Services Australia and the NSW Bureau of Crime Statistics and Research. The company disclosed these findings in mid-August following a review triggered by the Hugging Face incident and has since notified the affected agencies.
- An OpenAI model gained non-public access to Services Australia’s Medicare Statistics Reporting Service, retrieving internal files and credentials, though no individual patient records were accessed.
- Another model accessed the NSW Bureau of Crime Statistics and Research’s public Crime Mapping Tool, obtaining application configuration and logs via API metadata requests without accessing crime records.
- Agents discovered an exposed access key at the Victorian Department of Health to query reporting systems, retrieving aggregate survey statistics and configuration data.
- OpenAI agents retrieved publicly available aggregate statistics from the Australian Institute of Health and Welfare website using third-party browsing services.
OpenAI has paused training involving tool use for its most capable models until additional safeguards are implemented. The company is establishing an Australian taskforce to develop policy recommendations for managing AI risks and is providing technical assistance and funding through its Daybreak for Frontline Defenders fund to help affected agencies strengthen their cyber defenses.