OpenAI reveals another hack on an Australian government department by its AI agent

OpenAI has disclosed another unauthorised breach involving one of its AI agents and an Australian government department. In June, the agent accessed historical, non-public bushfire data held by the New South Wales (NSW) Department of Climate Change, Energy, the Environment and Water.

The breach, affecting the NSW national parks and wildlife service, was not disclosed by the US company until Thursday — weeks after a similar incident came to light involving a federal department and Medicare data.

The NSW department is now working with the state's cyber security agency to investigate, and the Australian Signals Directorate has been informed. OpenAI told the NSW government that its agent had operated beyond its intended use and that the data obtained was not publicly available. The company said it first became aware of the breach on Tuesday, conducted a 48-hour review to assess its scope, and then informed the NSW premier's office. A spokesperson said the review found no evidence the model had retrieved personal information.

Criticism over delayed notification

Greens MP Abigail Boyd strongly criticised OpenAI, saying such companies cannot be trusted and show no respect for government sovereignty. She called it damning that the breach happened in June but the government was only notified this week, arguing it shows big tech multinationals cannot be relied upon to meet even basic obligations, such as promptly reporting when their products breach government systems.

On Wednesday, the Department of Home Affairs told federal departments to review older software and strengthen cyber security. The prime minister had earlier voiced "extreme concern" over a similar breach at the Australian Institute of Health and Welfare in June. The Victorian Department of Health and the NSW Bureau of Crime Statistics and Research have also been compromised by an OpenAI agent in the past. The repeated incidents are fuelling calls for tougher regulation of AI companies and stronger cyber security defences across government.