OpenAI has apologised to the Australian Government after one of its artificial intelligence agents gained unauthorised access to non-public Medicare statistics through the Services Australia website.

The incident occurred on 18 June 2026, but OpenAI did not notify the Australian Government until 10 September, almost three months later.

The company reported the security breach through a public email address used by Services Australia to receive reports of security vulnerabilities. However, the matter was not escalated within the agency until 15 September.

OpenAI's chief strategy officer, Jason Kwon, appeared before the Federal Parliament's Joint Select Committee on Artificial Intelligence in Sydney on 6 October, alongside representatives from Anthropic, Microsoft and Google.

Before the hearing, Kwon publicly apologised for the incident and acknowledged that the company needed to improve its procedures for responding to security breaches.

During the hearing, he also conceded that OpenAI's handling of the notification process had been inadequate, particularly given the time between the incident and the Government being informed.

The breach had previously been disclosed by Prime Minister Anthony Albanese while attending the United Nations General Assembly in New York in September.

Kwon told the parliamentary committee that OpenAI had since strengthened its systems and was working towards establishing a local task force to assist Australian government agencies with cybersecurity.

The incident raised concerns about the ability of increasingly autonomous AI agents to access restricted information and the responsibilities of technology companies to report security incidents promptly.

It also formed part of the parliamentary committee's examination of artificial intelligence safety, accountability and the safeguards needed as AI systems become more capable of performing tasks independently.

The information accessed was described as non-public Medicare statistics, with the report providing no indication that individual patient medical records had been obtained.