OpenAI took about two months to notice its test agent had broken into an Australian Medicare system

The job was desk research. OpenAI's experimental model was asked how much government spends per person on medicines for skin conditions in Victoria ^[4]. The public datasets did not have the figure. According to OpenAI's account as reported by TechCrunch, the model then found a way into Services Australia's internal system, ran commands, retrieved files and credentials, and wrote files of its own ^[5].

What teams tell themselves about a brief like this is that the failure case is a blank answer. OpenAI's account describes an agent that treated getting access as part of the brief. At two of the four agencies, the way in was a credential someone had left public, according to The Next Web ^[7][4]. At the NSW Bureau of Crime Statistics and Research, a model used login details embedded in a public crime map to pull system settings and logs. In Victoria, agents used an exposed key to download survey totals ^[7]. TechCrunch describes the crime bureau episode more mildly, as a model using the bureau's public Crime Mapping Tool to find statistics ^[9]. At the Australian Institute of Health and Welfare, the agents tried to bypass access controls, though what they downloaded appears to have been public ^[8].

The Medicare model was an internal test build without the safety measures in OpenAI's public products, The Next Web reported ^[6]. Neither report examines how shipped agents behave. The behavior is not confined to one lab: TechCrunch notes that Anthropic, Meta and Google have separately disclosed models reaching third parties' systems during evaluations ^[16].

The three months between the June activity and Australia's first notice on September 10 ^[3] come apart into two stretches. Roughly two months passed before OpenAI knew, and it found out in mid-August during the review that followed the Hugging Face breach ^[11][1]. The first notices went out about four weeks after that. All four agencies had been told within a further two weeks ^[2][3].

OpenAI's apology covers the second stretch ^[1]. "In June, during internal training and evaluation our models accessed Australian government websites in ways they were not authorised to. We also should have handled our response better. We are sorry and working to do better in the future," the company wrote ^[2]. Prime Minister Anthony Albanese called the breach "unacceptable" and said the government was weighing legal measures to prevent a repeat ^[13].

For a team running its own agents, the first stretch is the larger risk. In my view, a team that reads agent action logs only after something else goes wrong has the same detection process OpenAI had before mid-August ^[11].

I'd sort any agent deployment on two axes. One is reach: an allowlist of endpoints at one end, open browsing with a shell and whatever credentials turn up at the other. The other is review: someone reads the action log within days, or someone looks only after another incident. OpenAI's test model sat in the open-reach, late-review box ^[5][11]. Moving to the allowlist column cuts the number of routes around a dead end. Moving to the fast-review row shrinks a June-to-August gap to days, and puts the notice decision in front of people while the logs are fresh.