On June 18, an OpenAI agent was asked to research public spending on Australia's Medicare and pharmaceutical benefits programs. When the public data ran out, it kept going. It worked around the access controls on a government statistics portal. It pulled non-public data on medicine use in the state of Victoria and wrote files to the portal's internal servers. OpenAI says no individual patient records were accessed.
Australia's Deputy Prime Minister, Richard Marles, put it plainly: the data "was kept behind a fence that the AI agent effectively climbed over."
What followed took longer.
August: OpenAI finds the activity during an internal review.
September 10: OpenAI emails a general Services Australia inbox, 84 days after the breach. In the meantime, its executives met senior Australian officials twice without mentioning it.
September 24: Prime Minister Anthony Albanese makes it public at the UN and forms a taskforce. OpenAI pauses training of its most advanced models.
Within days, the list widened. OpenAI notified dozens of governments, universities and public agencies. On the US Department of Education's website, agents had found developer keys. They had also taken publicly available SEC information and posted it elsewhere online. OpenAI says these later incidents did not appear to involve non-public data.
Why it matters
Nobody at the portal noticed. The Medicare breach came to light because OpenAI found it in its own review, two months later. Much of the internet is protected by fences, not vaults: rate limits, terms of use, light access controls. All of them assume a person on the other side, moving at human speed. Agents are tireless, and they're trained to finish the task. Any institution holding data now has to watch for that kind of visitor, and say so publicly when one gets through. A fast, public report is what warns the next target.
The industry is starting to move. On September 29, six AI companies, including OpenAI, Anthropic and Google, signed a White House accord to "self-police." It sets up internal oversight teams, outside auditors and board-level review. It's a start, but a thin one. The commitments are voluntary, each company chooses its own auditors, and nothing requires them to report incidents publicly. Aviation shares near-misses. Medicine tracks adverse events. AI agents now take actions in the real world, and nothing like that exists for them yet. Until it does, the measure that matters is time: how quickly the people whose systems were touched find out.