An OpenAI agent broke into Australian government systems in June, but the company waited about three months after the breach to notify the impacted agencies.
By Tim Leogrande, BSIT, MSCP, Ed.S.
🗓 OCT 15 2026 • 5 MIN 30 SEC READ
📝 Essay
In a breakout room at a recent security conference, a man in a quarter-zip jacket with an embroidered product logo demonstrated an agentic tool to perform security testing. “This agent figures out its scope on its own,” he announced.
More than a few people in the crowd chuckled, and there was a thin smattering of sarcastic applause. But some of the folks seated near me assiduously wrote this claim down.
I rolled my eyes and glanced over my shoulder at a friend who is a respected author of several InfoSec books and who has worked as a technical consultant on a handful of films and TV shows that feature hackers breaking into things. He was staring back at me and smirking while gently shaking his head.
I’ve been thinking quite a bit about that self-scoping agent since then, and about another agent, developed by OpenAI, that scoped itself into several Australian government systems in June.
On October 6th and 7th in Sydney, the Joint Select Committee on Artificial Intelligence held hearings. On day one, executives from OpenAI, Anthropic, Microsoft, and Google discussed everything from safety and copyright, to Australian investments in AI infrastructure, to whether frontier AI could help bad actors pull off a catastrophic biological attack. On day two, AI and data vendors, data center companies, and AI safety experts shared their thoughts with committee members.
OpenAI chief strategy officer Jason Kwon opened his testimony by apologizing for the company’s failure to discover and adequately report the incidents: an OpenAI agent breaching a portal associated with the Services Australia Medicare Statistics Reporting Service in June, plus gaining, or trying to gain, unauthorized access to four other Australian government systems. During the Medicare breach, the agentic system ran commands, retrieved internal files, data, and credentials, and wrote files. Fortunately, patient medical records were spared.
<aside> 💡
Asked whether OpenAI models could break into an oil and gas facility, Kwon replied, “We don’t know.”
</aside>
Kwon then urged organizations running critical infrastructure to revisit their penetration testing processes to prepare for AI-grade attacks.
OpenAI learned about the government system breach two months after the hack, and waited another month to notify the impacted government organizations. This occurred while OpenAI CEO Sam Altman met with Australian deputy prime minister Richard Marles. Kwon told committee members that Altman wasn’t aware of the hack during that meeting.
David Masters, Anthropic’s head of policy for Australia and New Zealand, said that a web of different regulations around the world “adds complexity.” None of the industry witnesses argued against breach reporting legislation, but many wanted one harmonized set of global regulations. The four AI companies that testified are pleading for time.
That stuck with me because global AI regulations would take years to develop. Many, many years. And I believe it’s crucial that governments move right away on agentic hacking disclosure laws.
Brisbane-based Huntress cybersecurity expert Jasa Rakus says an AI agent accessing a system outside its authorized scope should be “reportable by default.” He notes that current breach notification requirements are centered on harm-based factors, for example, how many people’s data was accessed, which allows companies to hold onto reports while they figure that out. I agree. There should be an objective trigger that mandates breach notifications.
<aside> 💡
Disclosure should be simple. Unauthorized access equals a reportable event. Full stop.
</aside>
It’s not always possible to calculate damages in cyber intrusions. Especially when runaway AI agents may still be roaming through a network. Agents hacking networks is bad enough, but slow-moving disclosure makes it even worse.