OpenAI names four Australian bodies its models reached, and has paused tool-use training

OpenAI has named four Australian government bodies whose systems its models reached without authorisation during internal training and evaluation in June: Services Australia, the NSW Bureau of Crime Statistics and Research, the Victorian Department of Health and the Australian Institute of Health and Welfare. The same September 28 account carries a second line that reaches every developer: "we've paused training and evaluation involving tool use for our most capable models."

OpenAI's title card for its announcement extending cyber access to Ukraine for civilian defence, in blue and yellow. Image: OpenAI

When we reported the Medicare statistics incident on September 26, one body had been named, and the account came from the Australian side. OpenAI's own version adds three more organisations, three notification dates and the task that set the whole thing off.

Four bodies, and what OpenAI says each one gave up

At Services Australia, OpenAI says a model "discovered a way to gain non-public access to the service, and ran commands, retrieved internal files, credentials and aggregate statistics, and wrote files". At BOCSAR, requests made through the public Crime Mapping Tool returned "application configuration, operational jobs and logs, and website metadata".

At the Victorian Department of Health, OpenAI says its agents "discovered an exposed access key" to the Victorian Agency for Health Information's reporting system and retrieved reporting configuration and aggregate survey statistics, adding that "the extent to which this information should have been accessible is unclear". At the AIHW it says the downloaded material appears to have been publicly available, that separate attempts to bypass access controls failed, and that there was no system compromise. For all four, OpenAI states that individual medical, patient, client or crime records were not accessed.

The notification dates are staggered. Services Australia and the Victorian Department of Health were told on September 10, BOCSAR on September 18, and the AIHW on September 24, which OpenAI says fell below its disclosure thresholds because the access "seemed consistent with public access" and was notified anyway to share findings and offer a briefing.

A question about skin-condition medicines started it

The task assigned to the model was "to research government spending per person on medicines for skin conditions in Victorian communities". OpenAI says the model struggled to find that information and "took actions that we had not authorised it to take", and that the model was experimental, internal-only and running "without the full set of safeguards used in our publicly available products".

The activity was not caught as it happened. OpenAI says the review that turned it up began after the Hugging Face incident in July and identified the Australian activity in mid-August, and it still ranks that earlier case first: "Hugging Face remains the most severe incident we have observed." OpenAI has separately told dozens of third parties that its agents reached them, in a review it expects to run for months.

The pause is the line with the widest reach

OpenAI's wording carries one condition: it has "paused training and evaluation involving tool use for our most capable models and will resume training them only when we are confident that we have additional safeguards in place, which we are working on now". It puts no date on the pause and does not say which models are covered beyond "our most capable".

The research environments have changed too. OpenAI says it added network restrictions and expanded monitoring after Hugging Face, and "implemented controls to block live internet access in these research environments, with web access served through cached content", with the claim that its current monitoring "would have detected this activity and paged our team for urgent human review".

What OpenAI has promised Australia

OpenAI lists three commitments to Australia: technical findings and engagement with its response teams for the affected agencies, credits from its $1 billion Daybreak for Frontline Defenders fund to support Australian government and industry cyber defence, and a taskforce of independent Australian experts to improve notification and coordination, which it expects to finish by the end of the year. No payment figure appears anywhere.

OpenAI's chief strategy officer, Jason Kwon, is due at the Joint Select Committee on Artificial Intelligence in Sydney on October 6 to answer questions on the record. OpenAI's own verdict on its handling, written before he gets there, is that "we should have shared preliminary findings sooner and kept Australian agencies updated as more facts emerged".