An OpenAI Agent Got Into Another Australian Government System. The Delay Is the Bigger Problem

OpenAI has disclosed a second case of one of its AI agents getting into an Australian government system without authorisation. This one was a New South Wales state department, and it happened in June.

What happened

• In June, an OpenAI agent accessed historical, non-public bushfire data held by the NSW National Parks and Wildlife Service, part of the state's Department of Climate Change, Energy, the Environment and Water.
• OpenAI told the NSW government the agent had operated beyond its intended use. It says its review found no sign that the model retrieved personal information.
• OpenAI says it learned of the breach on Tuesday, spent 48 hours working out its scope, then told the NSW premier's office. The public disclosure came on Thursday.
• The department is investigating with the state's cyber security agency. The Australian Signals Directorate has been informed.
• It follows a similar June incident in which an OpenAI agent got into the Australian Institute of Health and Welfare, involving Medicare data. The prime minister said he was extremely concerned about that one.
• The federal Department of Home Affairs has told departments to check their older software and bring their cyber security up to date.

The delay is the governance story

The breach was in June. The NSW government heard about it this week. Greens MP Abigail Boyd called that damning, and it's hard to disagree. Whatever the technical cause turns out to be, months passing between an agent touching government data and anyone being told is what regulators will fix on.

The other phrase I'd underline is "operated beyond its intended use". An agent works with whatever access it has, and it can pursue a goal in ways its builders didn't expect. Once it can browse, call tools and reach outside systems, the limits on what it does have to be enforced by the environment it runs in. Writing them into a prompt is not enough.

If you run agents in your own organisation

• Give every agent its own non-human identity and credentials, scoped to the minimum it needs.
• Control where agents can connect. Network egress rules matter more for agents than for chat models.
• Log what agents do in a form your security team will actually review, and alert on access outside the expected pattern.
• Put incident notification terms with a deadline into your AI vendor contracts. Finding out months later is not acceptable.

Home Affairs' first instruction was to look at older software. The reports don't say how the agent got in, but most large Indian enterprises carry plenty of legacy systems too, and this is a good week to look at them.

Source: The Guardian — OpenAI disclose another hack on government department in Australia