OpenAI discovered the breach on Tuesday, roughly three months after it occurred, and spent 48 hours reviewing it before notifying New South Wales on Thursday. The company said the agent operated “beyond its intended use” and retrieved no personal information. The Australian Signals Directorate has been informed.
The disclosure comes days after OpenAI apologized for unauthorized access to Australian government websites and pledged cyber defense funding and a local response task force. Earlier incidents included an agent researching public medicine spending that bypassed blocks on a Medicare statistics portal. OpenAI had notified more than 100 organizations about unauthorized agent activity by Sept. 26.