Australia has suffered the first known case of an AI agent hacking into a government database. On 18 June, an OpenAI agent gained unlawful access to an Australian government website, more specifically the national healthcare database, gaining access to both public and private files from the website. The AI agent was exploring data about healthcare spending and bypassed security measures to access records that it had no authorisation to access.
According to Prime Minister Anthony Albanese, who first announced the incident at the UN General Assembly in New York, no patient’s private information has been accessed and data about medical histories and banking details were not compromised in the hack. Albanese also declared that three other government agencies may have been impacted, namely the Australian Institute of Health and Welfare, the New South Wales Bureau of Crime Statistics and Research and the Victorian Department of Health, but did not provide confirmation for the same.
An OpenAI spokesperson stated that the company learnt about the event in August during a comprehensive check into the AI model’s activities and logs. The company did not inform the government, instead waiting until 10 September to send an email to the public inbox of Australia’s Social Services department, an action that led to the delay of the news reaching the Minister by five days. Albanese, who spoke with OpenAI CEO Sam Altman, expressed his worries over the delay in informing the Australian government and how the notification was sent.
The Australian government has set up a task force to determine whether existing legal frameworks can successfully manage AI related offences, and whether a criminal offence has been committed if a similar incident occurs again. Current Australian legislation outlaws computer offences, but to determine who is legally responsible for AI related charges is still a matter of great ambiguity. OpenAI has also launched its own task force to address the issue and has sent its Chief Strategy Officer Jason Kwon to a parliamentary committee in Sydney on 6 October, which resulted in OpenAI apologising for the delay in informing the government, and the manner in which the notice was sent.
The Australian incident is not the first of its kind. Another major AI cyber attack occurred in July 2026, in which another group of OpenAI agents infiltrated the infrastructure of a tech company named Hugging Face, an organisation that deals with tools for machine learning. A rogue OpenAI agent broke out of its testing interface and penetrated the systems of Hugging Face. The manner in which this was done was eerily coordinated through AI only message boards, and there was a deliberate effort to conceal the actions of the AI, something that was highly unprecedented. This was just one of the many cyber attacks that have been conducted by OpenAI agents, an incident that has increased in frequency since May 2026.
Rogue AI as a phenomenon is no longer a figment of futuristic science fiction, but a very real possibility in today’s technological landscape. Dario Amodei, CEO of Anthropic, has called for greater AI regulation and safety measures in order to prevent such dystopian scenarios. There have been concerns across the boards at every major AI company on whether the safety frameworks that they have been creating are able to keep up with the rapidly evolving architecture of the AI models they are developing, a concern that is steadily becoming a crisis in modern technology.
Image Credits : Wikimedia Commons
Leave a Reply