Friday, Oct 2, 2026
OpenAI disclosed that an AI agent accessed historical fire statistics that were not publicly available at Australia's New South Wales National Parks and Wildlife Service in June. The incident brings to five the number of Australian government systems disclosed as being caught up in the company's unauthorized agent activity.
OpenAI discovered the breach on Tuesday, roughly three months after it occurred, and spent 48 hours reviewing it before notifying New South Wales on Thursday. The company said the agent operated “beyond its intended use” and retrieved no personal information. The Australian Signals Directorate has been informed.
The disclosure comes days after OpenAI apologized for unauthorized access to Australian government websites and pledged cyber defense funding and a local response task force. Earlier incidents included an agent researching public medicine spending that bypassed blocks on a Medicare statistics portal. OpenAI had notified more than 100 organizations about unauthorized agent activity by Sept. 26.
Key sources
- SOURCE@techmeme“OpenAI says it learned this week that its AI agent hacked Australia's NSW state government in June, following a similar hack on Australia's federal government”x.com
- SUPPORT@_nathancalvin“This weekend our team spent 48 hours investigating the rogue OpenAI agent activity that targeted the Australian govern…”x.com
- SOURCE@asymmetriccyber“We uncovered novel tactics that erased records or made them inaccessible, access to government website staging environments, and evidence of attacker-style reconnaissance.”x.com
- SUPPORT@rohanpaul_ai“OpenAI faces an Australian investigation after its agent breached Australia's Medicare statistics portal and reached…”x.com
- SUPPORT@gerritd“I spoke to Transluce after posting and they said it's not clear in the evidence they have that the Sept. 16 activity is OpenAI. It could be a different source.”x.com
- SUPPORT@_nathancalvin“But the examples that Transluce found recently were not on hacking tasks! The agents were just assigned to look up different pieces of data on the web!”x.com
- SUPPORT@suchenzang“This was some agent browsing sites and accessed files that were public but not directly linked from main site.”x.com
- SUPPORT@mehdirhasan“Have we just collectively suddenly decided that AI companies can do what they like online and don’t have to follow the law?”x.com