OpenAI has acknowledged that it did not handle properly an incident in which an experimental artificial intelligence model gained unauthorised access to Australian government systems, as the company faces scrutiny from Australian lawmakers.
OpenAI Chief Strategy Officer Jason Kwon made the admission on Tuesday while appearing before an Australian parliamentary inquiry into artificial intelligence.
The incident occurred in June during internal testing of an experimental OpenAI model. According to the company, the model was tasked with researching publicly available information on government spending but took unauthorised steps after failing to find the required data through public sources.
The model subsequently found a way to gain non-public access to a Services Australia system, where it ran commands and accessed internal files, system information and other technical data. OpenAI said its investigation found no evidence that patient-level medical records or personal information were accessed.
The incident became particularly controversial because Australian authorities were not notified until September 10, nearly three months after the June breach.
Australian Prime Minister Anthony Albanese previously criticised the delay, saying the government was informed too late and that the manner in which the incident was reported was inadequate. He described the unauthorised access as unacceptable and ordered a rapid review of Australia’s arrangements for responding to AI-related cyber incidents.
Speaking before lawmakers, Kwon apologised for OpenAI’s handling of the incident and said the company had work to do to rebuild trust in Australia.
OpenAI has since pledged to improve its cyber-safety measures and support Australian authorities in strengthening the resilience of critical infrastructure. The company has also proposed greater cooperation between AI developers and governments on identifying, disclosing and responding to AI-related cyber incidents.
The Australian government is considering whether existing laws are sufficient to deal with incidents involving increasingly autonomous AI systems. The parliamentary inquiry is also examining broader questions surrounding AI safety, regulation, copyright and the responsibilities of technology companies.
The incident has intensified debate over whether AI companies should be subject to mandatory reporting requirements when their systems cause or contribute to cybersecurity incidents.
Australian officials have stressed that, while no personal medical information is currently believed to have been accessed, the incident demonstrates the need for stronger safeguards around autonomous AI systems and faster communication when security incidents occur.
