{"id":909961,"date":"2026-09-29T16:08:18","date_gmt":"2026-09-29T16:08:18","guid":{"rendered":"https:\/\/www.newsbeep.com\/au\/909961\/"},"modified":"2026-09-29T16:08:18","modified_gmt":"2026-09-29T16:08:18","slug":"revealed-the-five-paragraph-email-openai-used-to-inform-australia-about-agent-attack-openai","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/au\/909961\/","title":{"rendered":"Revealed: the five-paragraph email OpenAI used to inform Australia about agent attack | OpenAI"},"content":{"rendered":"

OpenAI has apologised to Australians for its agent attack on Medicare<\/a>, and will front parliament next week as the tech company revealed more details about its June hack of Australian government websites.<\/p>\n

Ministers on Tuesday evening released a brief, five paragraph email which OpenAI<\/a> used to inform the Australian government about the attack. The email was sent to a public inbox monitored by Services Australia on 10 September \u2013 nearly three months after the AI agent accessed the website on 18 June \u2013 and was signed off with the closing \u201cbest\u201d.<\/p>\n

The Labor government has publicly voiced its fury at the manner in which OpenAI disclosed the incident. The email itself, obtained by Guardian Australia, advised Services Australia that \u201can OpenAI model identified a way to make the server carry out instructions sent through the public reporting interface, without a private account or password\u201d.<\/p>\n

In a blog post<\/a> released on Tuesday morning (Aest), OpenAI said it should have handled its response better.<\/p>\n

\u201cWe also should have handled our response better. We are sorry and working to do better in the future.\u201d<\/p>\n

The company also provided more detail on the incident revealed by the Australian prime minister, Anthony Albanese<\/a>, last week.<\/p>\n

OpenAI said it became aware of agent activity on Australian government websites in mid-August after the company reviewed earlier training incidents after the Hugging Face attack<\/a> in July.<\/p>\n

The agents gained non-public access to a Services Australia portal for Medicare statistics, and OpenAI said the agent was able to run commands, retrieve internal files, credentials, and write files, but no patient or client records were accessed.<\/p>\n

\"RogueRogue AI hacks government system for first time – The Latest<\/p>\n

OpenAI\u2019s email to Services Australia pointed the government to the \u201caffected URL\u201d, a Medicare statistics page on the human services website, as well as specifying an \u201caffected report\u201d \u2013 a CSV file, commonly used for spreadsheets.<\/p>\n

\u201cWe recommend that the team responsible for the service investigate the vulnerability and assess the changes needed to prevent it. We would be glad to brief your security team and provide supporting evidence as available,\u201d OpenAI wrote.<\/p>\n

\u201cBest, OpenAl Security Team\u201d.<\/p>\n

OpenAI was contacted for comment.<\/p>\n

The NSW Bureau of Crime Statistics and Research\u2019s public crime mapping tool was also accessed, with application configuration, operational jobs and logs and website metadata provided to the agency.<\/p>\n

The agent discovered an exposed access key to query the Victorian agency for health information\u2019s reporting system to access aggregate survey statistics.<\/p>\n

For the Australian Institute of Health and Welfare, OpenAI agents retrieved aggregate statistics, but separate attempts to bypass access controls were unsuccessful and the information obtained was publicly available.<\/p>\n

Services Australia and the Victorian health department were informed on 10 September, while the NSW bureau of crime stastistics was informed on 18 September.<\/p>\n

The Australian Institute of Health and Welfare was not informed until 24 September, as OpenAI deemed it did not meet disclosure thresholds.<\/p>\n

\u201cSince then we\u2019ve worked closely with Australian government agencies to share what we\u2019ve learned to date,\u201d OpenAI said. \u201cIf we identify any additional affected agencies, we will notify them promptly and directly with the information available and provide updates as further facts emerge.\u201d<\/p>\n

The incident occurred after one model was tasked to research government spending per person on medicines for skin conditions in Victoria. The model had difficulty obtaining that information, and OpenAI said \u201cit took actions that we had not authorised it to take\u201d including accessing Services Australia\u2019s Medicare statistics reporting service.<\/p>\n

OpenAI said it would commit resources and expertise to affected agencies, and provide Australian government agencies with support to build cyberdefences on critical infrastructure.<\/p>\n

Australian government agencies and industries will also be given credits out of OpenAI\u2019s US$1bn (AU$1.4bn) Daybreak fund, which lets those organisations use frontier AI for cyberdefence, and to harden their systems by reviewing code and system configurations for potential vulnerabilities that can then be patched.<\/p>\n

The company said it would also establish a taskforce with Australian expertise to develop practical policy recommendations on managing risk with AI agents.<\/p>\n

OpenAI\u2019s chief strategy officer, Jason Kwon, will appear at the joint select committee on AI on Tuesday 6 October. Guardian Australia reported on Monday <\/a>that Anthropic would also appear at this hearing, but not at a Senate inquiry into AI and datacentres this week.<\/p>\n

Albanese, who was in the United States last week when he announced the hack, said at the time he had spoken with OpenAI\u2019s chief executive, Sam Altman<\/a>, \u201cto express Australia\u2019s extreme concern about this incident\u201d.<\/p>\n

On Tuesday, Albanese said OpenAI had been \u201cvery constructive and open in engaging\u201d since the incident, as had Anthropic. He said AI can improve economic growth and productivity but it also carries risks.<\/p>\n

\u201cAnd we\u2019ve seen those risks exposed \u2013 not just in what occurred in Australia, but the revelation that has occurred in the United States and other countries as well.\u201d<\/p>\n

The federal government has flagged it could introduce mandatory reporting rules for AI-related data breaches, after the revelation OpenAI used a public-facing email address<\/a> three months after the hack to report the incident to Services Australia.<\/p>\n

The company said on Tuesday it had \u201ca lot of work ahead\u201d to rebuild trust with Australians but said it was making \u201cmeaningful changes\u201d.<\/p>\n","protected":false},"excerpt":{"rendered":"OpenAI has apologised to Australians for its agent attack on Medicare, and will front parliament next week as…\n","protected":false},"author":2,"featured_media":909962,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[43,44,41,39,42,40],"class_list":["post-909961","post","type-post","status-publish","format-standard","has-post-thumbnail","category-headlines","tag-headlines","tag-news","tag-top-news","tag-top-stories","tag-topnews","tag-topstories"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/909961","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/comments?post=909961"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/909961\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media\/909962"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media?parent=909961"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/categories?post=909961"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/tags?post=909961"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}