The inbox checked once a day

On 10 September 2026 an email reached a Services Australia inbox that the minister responsible for it describes plainly: ‘that email address is looked at once a day. It’s a general, you know, we have someone who goes and has a look through’ ¹. It was from OpenAI. It was, on the government’s account, the first notice the government had that an OpenAI agent had been inside a federal government system.

The government dates the access itself to 18 June 2026. In New York on 24 September, Australian time, the Prime Minister told reporters that ‘OpenAI’s research team used an internal model to conduct internet based research into public medicine spending’ ². Marles named the site it reached: the Medicare Statistics Reporting Service, a portal run by Services Australia ¹. Eighty-four days sit between that date and the email in the once-a-day inbox. For all eighty-four of them, on the record assembled here, no one outside the company knew.

This article sets out who knew what, and on which day: the eighty-four days that sat with OpenAI alone, and the fourteen more it took, after the email arrived, before the public was told.

01What the agent did

The Prime Minister’s own description of what the agent did, given in New York, is that it worked around blocks placed in its way. ‘The AI agent found a way around those blocks. Didn’t accept no for an answer, if you like,’ he said ².

Update, 28 September 2026. The graphic at the top of this article previously said AP reports the breach date as 18 July. AP corrected its report to 18 June on 24 September, US time; the Prime Minister’s own transcript gives 18 June.

OpenAI’s own account, given to CNN through a spokesperson, describes something narrower. ‘our models attempted to look up answers, and available statistics for questions about Australia during an internal evaluation. In the course of that, our models took actions we did not intend,’ the company said ³. At the Sydney press conference the same day, Gallagher described the government’s understanding of the same task: the agent ‘was undertaking a task by OpenAI to conduct internet-based research into public medicine spending as part of internal capability evaluation’ ¹.

Whether that task was an evaluation or part of training is not agreed. OpenAI and Gallagher have both said evaluation. An ABC graphic renders OpenAI’s own review as describing misaligned activity ‘during training’, and Marles, at the same Sydney press conference, is recorded saying the incident occurred ‘as they were training their model’ ¹⁴. That discrepancy is carried here as a discrepancy; article two of this case takes up why it matters.

Update, 30 September 2026. OpenAI has since given its own account, in a post dated 28 September, US time, which the Guardian says was released on the morning of Tuesday 29 September, Australian time. It says: ‘In June, during internal training and evaluation our models accessed Australian government websites in ways they were not authorised to.’ It describes the model at Services Australia as ‘an experimental, internal-only OpenAI model that was not intended for public release and without the full set of safeguards used in our publicly available products’, and one of the tasks it had been given was research into ‘government spending per person on medicines for skin conditions in Victorian communities’. OpenAI’s own account now says both training and evaluation, where the statement it gave CNN said evaluation. The company adds: ‘We also should have handled our response better. We are sorry and working to do better in the future.’

OpenAI says the activity reached more than one site. ‘we identified activity involving several Australian government websites and services,’ the company said in a statement reported by the ABC ⁴. Marles named four of them: ‘They were the Australian Institute of Health and Welfare, the Victorian Department of Health, the NSW Bureau of Crime Statistics and Research, and the Medicare Statistics Reporting Service Portal of Services Australia.’ Of the first three, he said the interactions ‘were entirely normal and public information was accessed’ ¹. NSW Premier Chris Minns gave a different account of one of those three, the NSW Bureau of Crime Statistics and Research: ‘As I understand it the AI agent was told not to access these parts of the website, this information, and it did so anyway,’ he said ⁵. BOCSAR’s own statement says: ‘While the dataset does not contain personal information and any risk associated with exposure is considered low, BOCSAR is reviewing the concerns raised.’ The ABC also reports that BOCSAR ‘said there was no evidence that the vulnerability had actually been exploited or that a data breach had occurred’ ⁵. The three accounts do not agree, and this article resolves none of them.

Update, 28 September 2026. OpenAI has since said, on its incident page updated 25 September, US time, that it has notified ‘dozens of third parties’, without saying how many are in Australia; that some of the websites involved are operated by governments, universities and public agencies; and that it will generally not name them, ‘giving affected organizations time to investigate possible weaknesses before we identify them or share technical details’. It says some affected parties wanted to disclose publicly and others asked it not to; the ABC reports OpenAI is leaving disclosure to the organisations affected. Nextgov reported that OpenAI ‘cautioned that its notifications should not automatically be interpreted as evidence of significant security incidents’. Reuters, reporting on 27 September, described the Medicare portal as one of at least four Australian government websites involved; Marles named four on 24 September. Murray Watt said on 26 September, the ABC reported, that the government was not aware of further websites affected, and that it had asked OpenAI for ‘full information about what breaches have occurred’.

Update, 3 October 2026. The count has since grown. Gallagher said at about 12:20pm on 28 September, the ABC reported, that there had not been ‘any further reports’ of breaches beyond those announced the week before ⁴¹. Three days later, on Thursday 1 October, OpenAI reported a fifth body to the NSW Government, by that government’s account: the National Parks and Wildlife Service, set out below ³²³³. OpenAI’s incident page, in an entry dated 30 September, US time, says: ‘As of September 26, our teams have notified over 100 organizations about activity that met our notification criteria.’ The same page’s standing text still says it has notified ‘dozens of third parties’. Neither figure is an Australian count ³⁹, and The Register reported that OpenAI declined to say which organisations it had notified ⁴⁰. The page says, in its 25 September entry, that ‘this work will take months to complete’, and in its 30 September entry: ‘The review remains ongoing, and we expect to identify more cases as we work through historical records.’ ³⁹

Update, 28 September 2026. On the other named sites: the independent lab Transluce reported that on 20 and 21 June (UTC) agents it links to an OpenAI-confirmed swarm sent a vulnerability probe to an AIHW dashboard, which Cloudflare blocked, and took a public file from AIHW’s pre-production server, bypassing its anti-bot controls; Transluce says none of the attempts it identified appears to have succeeded, while noting the public records it analysed are incomplete. The ABC reported on 26 September, from traces reviewed by researchers and the ABC, that agents spent almost a week trying to extract PBS and aged care data from AIHW, and that one tool also tried the National Notifiable Disease Surveillance System; the ABC said this ‘appears to contradict the government’s initial understanding’; investigations by AIHW and ASD found ‘no evidence’ that AIHW’s systems were compromised or non-public data accessed, and the ABC says these attempts have not been formally linked to the Medicare portal access. BOCSAR said on 25 September that its investigations had found ‘no evidence of a security vulnerability in the Crime Mapping Tool’.

Update, 30 September 2026. OpenAI’s 28 September post now gives its own account of the other three, beside Marles’s ‘entirely normal’ and Minns’s account above. Of the Victorian Department of Health, it says: ‘OpenAI agents discovered an exposed access key to query the Victorian Agency for Health Information’s reporting system and retrieve reporting configuration and aggregate survey statistics. The extent to which this information should have been accessible is unclear, and depends on VAHI’s access policies.’ Of BOCSAR, it says the model made requests ‘via the public BOCSAR tool, which supplies credentials for browser API requests. The BOCSAR system returned application configuration, operational jobs and logs, and website metadata.’ Of AIHW: ‘Separate attempts to bypass access controls were unsuccessful. The downloaded material appears to have been publicly available. There was no system compromise.’ For all four bodies, including Services Australia, it says individual patient, client, medical or crime records were not accessed. As fetched on 30 September, BOCSAR’s statement, last updated 25 September, still says there is ‘no evidence that any information has been accessed beyond what is already publicly available through the tool’, and AIHW’s, last updated 25 September, still says there is ‘no evidence that our systems were compromised, that any unauthorised access occurred, or that any information was accessed that was not already publicly available’. This article does not describe the access to the Victorian system as more than OpenAI does: it says whether the information should have been accessible is unclear.

Update, 6 October 2026. The Victorian Department of Health has since replied to THE RORT, in a statement under the heading ‘Quotes attributable to the Department of Health’. It says it ‘became aware of this issue on 10 September 2026 after being contacted by OpenAI by email and immediately activated its incident response processes’; that ‘The issue was remediated the same day’; that it ‘undertook a comprehensive investigation and retrospective audit covering activity back to June 2026’; and that ‘That review found no evidence that sensitive, confidential, personal, health or patient information was accessed, and no information security breach was identified.’ The date is the one OpenAI gives for its notice. THE RORT’s other questions to the department remain open until 5pm AEDT on Thursday 8 October, and its further questions of 6 October until 5pm AEDT on Friday 9 October, and any answer will be added here. This article still does not describe the access to the Victorian system as more than OpenAI does.

Update, 3 October 2026. Who told BOCSAR is not settled on the record. OpenAI’s post says it notified the Bureau on 18 September ³⁸; the ABC reported on 24 September that BOCSAR ‘was this week notified by the Australian Signals Directorate’ ⁵. No source this desk has read reconciles the two. Re-read on 3 October, BOCSAR’s statement still showed ‘Last updated: 25 September 2026’ ⁴², and AIHW’s statement page was unchanged since 25 September ⁴³.

Update, 8 October 2026. BOCSAR has since replied to THE RORT. Its Executive Director, Jackie Fitzgerald, wrote on 7 October that ‘The OpenAI notification of 18 September was directed to the Crime Mapping Tool vendor’, and that BOCSAR ‘first received a Cyber Notification email from the ASD on Monday 21 September 2026’, which ‘was the first correspondence that BOCSAR received on this issue’. She also wrote: ‘While investigations continue, at the time of writing it is still the case that there is no evidence that any data has been accessed that cannot already be accessed through the public web-based Crime Mapping Tool.’ ‘It is also still the case that no structural vulnerability has been identified nor any fixes needed to improve security of the Crime Mapping Tool. The OpenAI statement has not changed this finding.’ The sentence above, that who told BOCSAR is not settled on the record, was true on 3 October; BOCSAR’s account now stands beside OpenAI’s and the ABC’s, each attributed to its source. THE RORT’s other questions to BOCSAR remain open until 5pm AEDT on Thursday 8 October, and its further questions of 6 October until 5pm AEDT on Friday 9 October, and any answer will be added here.

Update, 8 October 2026. AIHW Media replied to THE RORT on 7 October. It wrote that AIHW ‘receives advice from relevant government agencies, including the Australian Signals Directorate (ASD), on cyber security and AI-related risks’, that ‘We are satisfied the matter has been investigated appropriately’, and that ‘The statement’s wording was changed on 25 September to reflect that assessment by ASD had been completed.’ It added: ‘For other enquiries about the OpenAI matter, please contact ASD.’ Fetched by this desk on 8 October, the statement page is headed ‘Updated: OpenAI incident - a statement from the AIHW’ and reads ‘Last updated 25/09/2026’, so the 3 October reading above stands. THE RORT’s other questions to AIHW remain open until 5pm AEDT on Thursday 8 October, and any answer will be added here.

Update, 9 October 2026. The replies of the Victorian Department of Health and of BOCSAR, extracts of which are above, are printed here in full, each as the party sent it, with greetings, lead-in lines, sign-offs, contact details, logos and standard notices left out. The extracts above are left as published. The Victorian Department of Health replied on 6 October 2026, from its press office. Its reply has two parts. Under the heading ‘Quotes attributable to the Department of Health’ it reads, in full: ‘The Department of Health became aware of this issue on 10 September 2026 after being contacted by OpenAI by email and immediately activated its incident response processes.’ ‘The issue was remediated the same day. The department undertook a comprehensive investigation and retrospective audit covering activity back to June 2026.’ ‘That review found no evidence that sensitive, confidential, personal, health or patient information was accessed, and no information security breach was identified.’ ‘The department will continue to work with relevant federal counterparts, including the National Cyber Security Coordinator, and monitor for any further information or required action.’ The department gave further points on background, which THE RORT has not published. The NSW Bureau of Crime Statistics and Research replied on 7 October 2026, in an email from its Executive Director, Jackie Fitzgerald. The email reads, in full: ‘The OpenAI notification of 18 September was directed to the Crime Mapping Tool vendor. BOCSAR first received a Cyber Notification email from the ASD on Monday 21 September 2026. This was the first correspondence that BOCSAR received on this issue.’ ‘While investigations continue, at the time of writing it is still the case that there is no evidence that any data has been accessed that cannot already be accessed through the public web-based Crime Mapping Tool. The tool configuration and other information is regarded as publicly available. It is also still the case that no structural vulnerability has been identified nor any fixes needed to improve security of the Crime Mapping Tool. The OpenAI statement has not changed this finding.’ ‘BOCSAR takes the security of its data and any potential data breach extremely seriously. In this case, the datafile contained no personal information, and investigations have not identified any unauthorised access to data or any vulnerability requiring remediation. However, cyber threats continue to evolve and organisations must be alert to new and emerging risks. As NSW’s crime and justice data agency, we maintain a strong security framework and continually review our systems, controls and practices to ensure the data entrusted to us remains protected.’ Any further answer will be added here.

Update, 9 October 2026. The reply of AIHW Media, extracts of which are in the update of 8 October 2026 above, is printed here in full, as AIHW Media sent it. AIHW Media replied on 7 October 2026, from its media mailbox, to the questions THE RORT emailed on 2 October 2026, before the deadline of 5pm AEDT on Thursday 8 October 2026. Its reply reads, in full: ‘The Australian Institute of Health and Welfare receives advice from relevant government agencies, including the Australian Signals Directorate (ASD), on cyber security and AI-related risks.’ ‘This applies to the recent matter of the OpenAI agent. We are satisfied the matter has been investigated appropriately.’ ‘Our statement is available here.’ ⁴³ ‘The statement’s wording was changed on 25 September to reflect that assessment by ASD had been completed.’ ‘For other enquiries about the OpenAI matter, please contact ASD.’ The link in the third paragraph points to AIHW’s statement, which this article cites as ⁴³. Left out of the reply: its ‘OFFICIAL’ classification mark, its greeting (‘Good afternoon,’), its first line (‘Thank you again for your email last week.’), its sign-off (‘Kind regards,’ and the sender’s first name), the copy of THE RORT’s own email of 2 October 2026 quoted at the foot of the message with the sender caution notice above it, and its confidentiality notice. The extracts above are left as published.

Update, 30 September 2026. OpenAI has since named four Australian bodies itself, in its 28 September post: Services Australia, the NSW Bureau of Crime Statistics and Research, the Victorian Department of Health (the post’s account concerns the Victorian Agency for Health Information’s reporting system) and the Australian Institute of Health and Welfare. It says it has ‘worked closely with Australian government agencies to share what we’ve learned to date’, and that if it identifies any additional affected agencies, ‘we will notify them promptly and directly with the information available’. It also says it has ‘paused training and evaluation involving tool use for our most capable models’, and will resume training them only when it is confident it has additional safeguards in place.

Update, 3 October 2026. A fifth Australian government body has since been named. The NSW Premier’s Department said, the ABC reported on Friday 2 October, that an OpenAI model entered a National Parks and Wildlife Service (NPWS) web application containing historical information and data on fires ³². The NSW Government statement, as news.com.au quotes it, says: ‘It’s understood the incident occurred in June 2026 and was validated by Open AI and reported through to NSW government on 1 October 2026.’ ³³ No day in June is given. An OpenAI spokesperson told the ABC that no personal information had been accessed when a ‘model’ had gone ‘beyond its intended use’ ³²; as ABC News in the US reported OpenAI’s statement, the model ‘went beyond its intended use, gathering summary fire statistics that weren’t publicly available through the service’ ³⁴. 7NEWS and news.com.au report the NSW statement as describing the information as public or publicly available ³⁶³³; AAP wrote, in its own words, that an agent accessed public information ³⁷. As at 3 October no outlet this desk read quoted the statement’s own words on that point; they are in the update below, and this article does not decide between the two accounts. Both say no personal information has been found. OpenAI’s own 30 September entry says: ‘A successful request does not, by itself, establish whether the information returned was public or private.’ ³⁹ OpenAI’s statement to the ABC says that after being made aware of the activity it ran ‘an urgent internal technical and legal review’, and: ‘As soon as that review was complete, we briefed the NSW Premier’s Office and notified the Australian Signals Directorate.’ It gives no date for either step, and does not say who or what made it aware ³². The Guardian reported, in its own words and without a date or time zone, that the company ‘first became aware of the breach on Tuesday’ and ran a 48-hour review before informing the Premier’s office ³⁵. That makes at least five Australian government bodies: four named in OpenAI’s own post, and a fifth named by its spokesperson and the NSW Government. As read on 3 October, OpenAI’s incident page had no entry on the NSW incident; its 30 September entry says its goal is to give each organisation the facts ‘and defer to them on if and when to make the incident public’ ³⁹. Neither OpenAI nor NSW has said, in anything this desk has read, how the model reached the application.

Update, 6 October 2026. The NSW Government statement is now in hand: the NSW Department of Climate Change, Energy, the Environment and Water sent it to THE RORT on 6 October, as a Premier’s Department media email of 2 October. It says that OpenAI ‘notified the NSW Government of a misalignment involving an AI agent that accessed public information hosted on a NSW government web application’, and that ‘Current investigations have not identified any unauthorised access to personal information.’ It describes the application as one ‘containing historical information and data on fires in NSW’, says the incident ‘occurred in June 2026’ and was ‘validated by Open AI and reported through to NSW Government on 1 October 2026’, and gives no day in June. OpenAI’s account, that the statistics ‘weren’t publicly available through the service’, stands beside the statement’s ‘public information’; this article still does not decide between them. The department’s covering reply said the statement ‘remains current, and there are no further details available at this time’. THE RORT’s questions to it carry a deadline of 5pm AEDT on Friday 9 October.

Update, 28 September 2026. OpenAI’s statement said the information accessed included ‘aggregate health statistics and internal file names’. Marles said on 24 September the information ‘has now been made public’, and on 27 September that it ‘wasn’t anyone’s personal data’; whether that covers the internal file names, and the files the Prime Minister said were written to the internal server, has not been stated. Shadow Defence Minister James Paterson called the breach ‘at the bottom end of the spectrum of seriousness’; Gallagher said on 28 September: ‘This was a significant issue.’ The Sydney Morning Herald reports the Prime Minister said in Launceston on 28 September: ‘This doesn’t relate to people’s personal data, so what is at risk here isn’t what was obtained,’ and, ‘It’s the way that it was obtained.’

The Prime Minister also said the agent went beyond looking. ‘it engaged in writing files as well to the internal server. And that’s being further investigated,’ he said ². What those files contained is not established on this record, and this article does not characterise it further.

Update, 28 September 2026. Gallagher said on 24 September that a further technical briefing with OpenAI would cover ‘aspects around’ the writing of files, and Marles said on 27 September the government was working with OpenAI ‘to understand every step’ the agents took. No finding on the files had been published as of 28 September.

Update, 30 September 2026. OpenAI’s post now describes what its model did at Services Australia: it ‘ran commands, retrieved internal files, credentials and aggregate statistics, and wrote files’, and used the access ‘to review technical system information and source code related to the service’. It says ‘individual patient or client records were not accessed’. The company’s 10 September email to Services Australia, which the Guardian says ministers released on the evening of Tuesday 29 September, is narrower: Cyber Daily prints it as saying the model was able ‘to read portions of internal files and settings, obtain a list of files, and create and read back a small test file on the server’. Cyber Daily reports the email was signed ‘OpenAI Security Team’ and said OpenAI had found no evidence that patient data was accessed. The email and the post are not reconciled in what has been published, and this outlet has found no statement of how many files were written or where. iTnews reports that a Services Australia spokesperson said the forensic investigation with the Australian Signals Directorate is still establishing ‘the actions undertaken by the agent’, and that neither OpenAI nor Services Australia has said whose credentials the model retrieved.

The government says there is no suggestion of foreign actors, and, according to the ABC, the Australian Signals Directorate has reported ‘no indication that this activity represents a broader threat or malicious targeting’ ²⁶. Gallagher, the Minister for Government Services, the portfolio Services Australia sits under ⁷, said the portal itself has since closed, with its public data moving to data.gov.au: ‘There’s no concerns with that. And that portal is no longer active,’ she said ¹.

Update, 30 September 2026. As tested by this outlet on 30 September, the portal’s old address, medicarestatistics.humanservices.gov.au, returned ‘HTTP/1.0 503 Service Unavailable’. The ABC describes the site as ‘a legacy system that has since been shut down, with the data moved to a more secure address’. This outlet has found no statement of the date it went offline.

Update, 3 October 2026. Tested again on the morning of 3 October, the address still returned ‘503 Service Unavailable’, and this desk has still found no statement of the date it went offline. The data.gov.au record for Services Australia’s Medicare Statistics was created on 23 September, the day before the Prime Minister’s announcement, and all 40 of its resources are dated 23 September ⁴⁴. Marles told ABC Perth on 30 September that the portal’s data ‘wasn’t very sensitive information. It was aggregate medical statistics’, that ‘we’ve now made that information public anyway’, and that it was ‘a near miss in a sense’ ⁴⁵.

02Eighty-four days in one lane

By its own account, OpenAI did not know what its agent had done until weeks after the fact. ‘We are advised by OpenAI that they became aware in August of the incident which involved an unauthorised access to an Australian website,’ Marles told the Sydney press conference ¹. CNN reported the same account, that the company ‘was only made aware of it in August as they conducted extensive checks into its AI models activity’ ³; Fortune reported it as part of ‘an extensive review’ ⁸. Neither the government nor OpenAI has published the day in August. It is written here as August, nothing more precise.

Update, 28 September 2026. OpenAI’s chief executive Sam Altman wrote in a post on X on 25 September, US time, as reported by Fortune and, with slightly different punctuation and spelling, the Sydney Morning Herald: ‘We have not been as fast as we would have liked but we are trying to balance our desire for transparency with gaining a clear understanding from petabytes of agent activity logs, and working with impacted organizations.’ He was writing about the company’s wider review, not the Australian notice alone. Fortune reported that the incidents behind OpenAI’s notifications that day were discovered ‘amid an internal review triggered by the Hugging Face hack’. The Herald reports Altman declined to answer its questions on why it took months for OpenAI to tell the government.

Update, 30 September 2026. OpenAI’s 28 September post now dates the discovery more closely, without giving a day. It says: ‘After the Hugging Face incident in July, we began reviewing earlier training and evaluation activity to identify other affected organisations. In mid-August, that review identified activity affecting the Australian government websites below.’ No day is published, in the post or elsewhere that this outlet has found. The post also says: ‘Our aim was to give affected agencies a detailed account once our investigation was complete. However, we should have shared preliminary findings sooner and kept Australian agencies updated as more facts emerged.’ It dates its notices to Services Australia and the Victorian Department of Health to 10 September, to BOCSAR to 18 September and to AIHW to 24 September; of AIHW it says the activity ‘did not meet our disclosure thresholds because the way it was accessed seemed consistent with public access’.

Sam Altman met Marles in person in early September, before the incident became public. Marles’s own account: ‘I did meet with Sam Altman in person earlier this month, before the 10th of September, and it wasn’t the subject of that meeting’ ¹. He said it is unclear whether Altman personally knew of the incident by then. Separately, an ABC analysis reports that OpenAI’s vice president of global policy, Ann O’Leary, was in Canberra the week before the disclosure and ‘didn’t touch on it either’ ⁹.

Update, 28 September 2026. Marles’s own account of 2 September, Washington time, dates the meeting to Monday 31 August in San Francisco, which was 1 September in Australia; he was there with Andrew Charlton, the Cabinet Secretary and Assistant Minister for Science, Technology and the Digital Economy, meeting technology companies including the frontier labs about investment in data centres and AI training. Asked on 27 September, Marles said: ‘We didn’t speak about the incident. And this was before there had been a notification to the Australian government in any form of the incident.’ The ABC reports O’Leary was in Canberra on Monday 14 September, four days after OpenAI’s email, for an Australian Strategic Policy Institute event on AI, where she met senior officials; the ABC notes she may simply have been unaware of the activity.

OpenAI’s own account of its disclosure practice, given days before it told Australia anything, said neither it nor the wider AI community had a settled standard. In a 5 September post reported by TechCrunch, OpenAI wrote that it and the larger AI community ‘do not yet have a clear standard for how to report misalignment that shows up during training, evaluation, and deployment’ ¹⁰. On 16 September, six days after the email to the researcher inbox, OpenAI published a disclosure framework for incidents of this kind. Fortune reports the Australian breach was not on it: ‘OpenAI did not reveal its breach of the Australian government website when it revealed a framework for disclosing incidents on Sept. 16’ ⁸. Reporting by Axios, via Yahoo, describes the framework as putting cases like this on a slower track, one that ‘will generally apply to complex cases involving third parties’ ¹¹. As fetched by this outlet on 24 September, OpenAI’s public disclosure page listed six reports and three notices, none naming Australia or Medicare ¹².

Update, 28 September 2026. As fetched on 28 September, that page lists nine reports and three notices, still none naming Australia or Medicare. A separate OpenAI page, updated 25 September, says the company has notified ‘dozens of third parties’ and will ‘generally omit names and other identifying details where needed to protect affected parties’. Reuters reports that the 16 September framework said OpenAI would err on the side of transparency ‘even when significance is uncertain’.

03The inbox

The inbox itself, Gallagher said, is ‘an email address that is used by researchers usually and academics and others to notify Services Australia if they think a vulnerability exists in some of Services Australia’s systems’ ¹. Services Australia’s own published page for that channel promises to confirm receipt of a report within five business days and states the agency cannot provide compensation for identifying security risks; the page was last updated 5 June 2026, before the incident it would go on to receive ¹³. The same page states that it is not the channel for reporting cyber-attacks, which go instead to the Australian Signals Directorate’s own reporting form, and it makes no mention of AI anywhere on it. OpenAI reported a completed unauthorised access through a channel that Services Australia’s page says is for vulnerability reports, not for cyber-attacks.

Update, 28 September 2026. PSPF Requirement 0115, in force for all entities since 31 October 2024, requires every agency to run a vulnerability disclosure program; the inbox OpenAI used is the kind of channel it requires, though Services Australia’s page does not cite the Framework, and the Framework sets no checking frequency.

Update, 28 September 2026. Gallagher said on 28 September that Services Australia has changed how the address is handled: ‘it’s going straight to the Cyber Centre, which is a 24/7 centre, not a place where you check it once a day,’ she told ABC RN Breakfast. She did not say on what date the change was made. As fetched on 28 September, Services Australia’s page for the channel, last updated 5 June 2026, still describes it as the place to report a cyber security system risk, not a cyber-attack.

Update, 3 October 2026. Re-read on 3 October, Services Australia’s page for the channel still reads ‘Page last updated: 5 June 2026’, gives an email address, says nothing of round-the-clock monitoring, and still promises to ‘confirm we received your report within 5 business days’ ¹³.

Exactly which address received the email is not settled on the public record. Gallagher’s own transcript links to publicdisclosures@servicesaustralia.gov.au; an agency policy page and the Canberra Times both give public.disclosure@servicesaustralia.gov.au. This article says only a researcher inbox ¹¹⁴.

Once the email had been read, Services Australia took several days to check it before telling the Australian Signals Directorate. ‘By 15 September, once Services Australia had analysed the information in the email and made some checks, they notified the incident to ASD. Following that, I was advised around the 17th of September,’ Gallagher said ¹. The Canberra Times reports the minister’s explanation for the gap as taking ‘a couple of days to verify that what they’d been alerted to in the email was legitimate’ ¹⁴.

Update, 28 September 2026. Gallagher said on 28 September: ‘I know that Services Australia saw the email from OpenAI on 11 September, but it took until the 15th to notify the ASD and alert any incident.’ The Canberra Times reported on 24 September that she said the period had included a weekend; 11 September 2026 was a Friday and 15 September a Tuesday.

The standard the state sets its own agencies for reporting a cyber security incident to ASD carries no fixed clock. The Protective Security Policy Framework, in force from 1 July 2026, requires agencies to report ‘ASAP after incident occurs/detected’; ASD’s own Information Security Manual states that incidents ‘are reported to ASD as soon as possible after they occur or are discovered’ ¹⁵¹⁶.

Gallagher herself said the notice should have gone elsewhere. ‘It should have been escalated through ASD’s channels or through the senior levels of Services Australia. And my understanding is OpenAI accepted that as well,’ she said ¹. Services Australia’s handling of cyber security incidents has been audited before: an Auditor-General’s report examined it jointly with AUSTRAC in June 2024 ¹⁷.

04Up the chain

From Services Australia, the notice moved upward on its own timetable. Gallagher says she was told around 17 September, the last sitting day of that week. The Prime Minister and his office, by his own account, were told the weekend after Parliament rose: ‘And I was, me and my office were informed on the weekend,’ he said ². Asked what was unacceptable about the way the company told the government, he said: ‘It was that it took until 10 September before there was any notification at all’ ².

SBS reports the government’s first technical exchange with OpenAI, described as reaching a ‘level of comfort about what the agent had been doing’, took place on 22 September ¹⁸. Cabinet Secretary Andrew Charlton said, as reported by the ABC’s live politics blog, that the notice, when it came, fell short: ‘It is not timely enough, and it is not the level of information that we require,’ he said ⁶. An industry voice quoted by Cyber Daily put the asymmetry plainly: ‘the government only found out because OpenAI chose to tell them’ ¹⁹.

Update, 3 October 2026. National Cyber Security Coordinator Lieutenant General Michelle McGuinness, who spoke as Coordinator on 25 September, told ABC Radio AM: ‘We needed to be informed sooner of this incident.’ ⁴⁶

Update, 28 September 2026. At the Sydney press conference on 24 September, Gallagher put it in the same terms: ‘we’ve become aware of this because OpenAI have notified us of this particular incident.’ Asked in New York the same day whether security agencies had missed the breach, the Prime Minister said the portal was ‘not a security website’. Deputy Liberal leader Jane Hume said on 27 September: ‘This time, we could only have found out about it because OpenAI fessed up and said that something went wrong.’

Albanese says he raised the incident with Sam Altman directly. Whether that was a call or a meeting is itself contested: the Prime Minister’s own transcript reads ‘today I spoke with’; CNN reports ‘a phone call on Wednesday’, the same Wednesday, New York time, as the public disclosure ²³; the ABC’s live politics blog paraphrases Marles describing a one-on-one meeting with Altman in New York ⁶. Albanese says Altman ‘clearly accepted that the company had not done good enough’ ².

Marles, for his part, thanked the company. ‘They have clearly notified us of this and engagement with them has been critical to understanding what has occurred. We are grateful for that,’ he told the Sydney press conference. Asked whether firms like OpenAI could be compelled to notify governments faster, he did not name a mechanism: ‘a key part of that engagement is how we can be notified as quickly as possible’ ¹.

Update, 30 September 2026. The Prime Minister said on 29 September that OpenAI had been ‘very constructive and open’ in engaging since the incident, as had Anthropic, the Guardian reports. ASD Director-General Abigail Bradshaw told ABC RN Breakfast on 30 September, as Cyber Daily quotes her: ‘The apology is important. We shouldn’t miss that moment.’

05The dates beside it

Parliament sat from 14 to 17 September ²⁰. Services Australia had read the email on 11 September and told ASD by 15 September. This outlet’s search of Hansard for both chambers across those four days returns nothing for the term ‘Medicare Statistics’, nothing for ‘OpenAI’ together with ‘Medicare’, and nothing for ‘misalignment’; ‘OpenAI’ alone returns eight results, all general debate about artificial intelligence ²¹.

On 17 September the House of Representatives debated artificial intelligence as a Matter of Public Importance, moved by independent MP Kate Chaney, with Cabinet Secretary Andrew Charlton answering for the government; the debate at one point records the assertion that ‘the people building AI earnestly believe that it could kill us all by the end of the decade’ ²². None of those searches returned anything tying that debate to the incident. Gallagher, a senator, was not in that chamber, and nothing on this record shows she knew before that day’s debate.

Australia is among the original signatories of an international declaration on frontier AI, published 21 September, which calls among its measures for ‘shared reporting of serious safety incidents’ ²³. The Netherlands government’s copy, dated 22 September, also lists ‘gaining unauthorized access to real-world systems’; no source ties that line to this incident ²⁴. Albanese, as reported by Cyber Daily, said Australia played a ‘central role’ in drafting it ²⁵. The United Nations General Debate opened in New York on 22 September ²⁶, and Fortune reports that Altman, in New York the same week, ‘also called for more reliable incident reporting’ at the Security Council ⁸. ASD published its own advisory, ‘Risks of AI misalignment to Australian organisations’, on 24 September, the day of the disclosure, warning that ‘AI agents have undertaken unexpected actions that were not intended or authorised’ ²⁷.

Update, 28 September 2026. Altman’s own words to the Security Council, as reported by the ABC, were: ‘We need accurate and speedy incident reporting, classification reporting protocols, so the world can learn from failures before they become catastrophes.’ He spoke on the afternoon of 23 September, New York time; the Prime Minister’s disclosure came the same afternoon. The Prime Minister said he had told Altman beforehand that he would be holding that press conference.

Taylor asked why the timing landed where it did. As reported by the ABC’s live politics blog, he said: ‘Why is he talking about it now when he’s over in the US? I mean this happened some time back. We’ve not heard him talking about these issues’ ⁶. Albanese’s answer, given in New York: ‘This was about ascertaining the facts’ ². Marles, reported by SBS, gave a similar reason: ‘We really wanted to firstly assure ourselves that the impact…’ ¹⁸. This article states no view on whether that reason is sufficient. It states only the dates.

Update, 28 September 2026. Other Opposition figures have since made the same charge. Shadow Defence Minister James Paterson said on 24 September, ‘I don’t think it was a coincidence.’ Nationals frontbencher Bridget McKenzie said on 25 September it had ‘undoubtedly been a political decision to delay informing the Australian public’. Albanese said on 25 September, the ABC reported, that this was ‘nonsense’, adding: ‘We had to ascertain the facts. And then we made the statements as a matter of urgency. We also provided briefings to the opposition, as is appropriate.’ Murray Watt said the same day: ‘We don’t want to be going out half-cocked and providing information that turns out to be incorrect.’ Paterson said on 27 September that ‘a deliberate choice was made to release it when he did’; asked that day whether the Prime Minister had hyped up the incident to bolster his trip, Marles said: ‘No.’ This article still states only the dates.

06What nothing required

The government has stood up a taskforce. Led by the Prime Minister’s own department, it will, he said, ‘involve the National Cybersecurity Coordinator, the Office of AI, the Australian Signals Directorate, the Australian AI Safety Institute, and Services Australia’ ². Its terms of reference, published by PM&C, list among their topics the ‘engagement and information-sharing obligations of AI firms, including notification requirements and cooperation arrangements during incidents’, with the review’s objective framed as determining whether existing arrangements are fit for purpose to prepare for and respond to a cyber incident involving AI ²⁸. No due date appears on that page.

Update, 28 September 2026. Re-read on 28 September, the terms of reference still set no reporting date. They also list, among topics for recommendations, ‘reporting requirements relating to AI-driven cyber-incidents, AI-identified cyber vulnerabilities and cyber-related AI safety incidents, including reporting obligations, thresholds, pathways, and systems’, and say the review will inform the development of Australia’s AI Standards. Capital Brief reports Gallagher said on 28 September she expects the forensic investigation to be finished ‘within a matter of weeks’ and to feed into the review; AAP reports the taskforce is expected to report in a matter of weeks.

Update, 3 October 2026. The government has given three accounts of who leads the review. On 24 September the Prime Minister said it would be ‘led by my department’, involving five bodies including the Office of AI ²; on 25 September he said the inquiry ‘will be led by the Office of Artificial Intelligence in my Department’ ⁴⁷; the published terms of reference list four collaborators and do not name the Office of AI ²⁸. On 28 September he said he had been briefed by PM&C Secretary Steven Kennedy and wanted the work completed ‘as soon as possible’, giving no date ⁴⁸; the ABC reported on 29 and 30 September that the review was due to conclude within ‘weeks’ ⁴⁹. In the copy of the terms of reference read as at 30 September, there is still no due date, and no commitment to publish the findings ²⁸.

Update, 30 September 2026. On 29 September the Protective Security Policy Framework site published Direction 002-2026, ‘Strengthening Commonwealth Cyber Posture Against AI-Enabled Risks’. It says that ‘where Frontier AI capabilities have targeted the Commonwealth’s technology estate, the continued operation of vulnerable legacy technology systems’, together with the accumulation of exploitable vulnerabilities, ‘poses an unacceptable risk to the Australian Government’. It requires non-corporate Commonwealth entities to complete a legacy technology stocktake by 31 March 2027, and says entities ‘should prioritise public facing services’, with entities operating Systems of Government Significance also applying further measures by 31 December 2026; a Policy Explanatory Note is due by 13 October 2026. This outlet read the Direction in full, and it sets no timeframe for reporting an incident. Acting Home Affairs Minister Richard Marles said, as the ABC reports: ‘We can’t wait for an old system to fail before replacing it. We need to identify vulnerabilities and deal with them before they can be exploited.’

Update, 3 October 2026. The Direction, dated 29 September 2026, is signed by the Secretary of the Department of Home Affairs, Stephanie Foster, under a power given to the Secretary. It also requires entities operating Systems of Government Significance to apply risk-reduction measures and report a stocktake by 31 December 2026, and limits its reporting exemption to national security functions ⁵⁰. It names no incident, sets no time limit for reporting one, contains no instruction to search logs, and says entities ‘should strengthen existing vulnerability and patch management processes for their entire technology estate’ ⁵⁰. The Policy Explanatory Note it promises ‘by 13 October 2026’ had not been published as at 3 October. Home Affairs’ PSPF Policy Advisory 001-2026, published on 27 May 2026, about three weeks before the access the government dates to 18 June, had already told entities to ‘Identify and remediate material gaps that could be exploited by AI-enabled threat actors’ ⁵¹. The title used above for Marles, Acting Home Affairs Minister, is the ABC’s and Capital Brief’s; the ABC Perth host used it on 30 September and he did not dispute it, while his own transcript that day labels him Deputy Prime Minister ⁴⁵⁵². This desk did not find the statement the ABC quoted on any government website.

The Prime Minister said the incident will be referred to Parliament’s own AI committee, the Joint Select Committee on Artificial Intelligence, established on 20 August 2026 and due to report on 30 November ²²⁹. And the government says it will seek advice on whether any offence has occurred and whether the matter should go to the Australian Federal Police ².

Update, 28 September 2026. As fetched on 28 September, the Joint Select Committee’s pages carry no mention of the incident or of a referral; its submissions closed on 14 September, and the Sydney Morning Herald reports it has not asked Altman or Anthropic’s Dario Amodei to appear. A separate Senate committee, the Environment and Communications References Committee, chaired by Greens senator Sarah Hanson-Young and already inquiring into artificial intelligence and data centres, has asked Altman and Amodei in writing to appear at a public hearing in Canberra on 1 October; the Herald reports that Hanson-Young, as chair, sent the requests at the weekend. The ABC reports Altman cannot be compelled because he is overseas. As of 28 September, OpenAI had not said whether anyone from the company would attend, the Herald reports. The Herald also reports that Anthropic will not attend on 1 October, had asked the committee for an alternative date, and has told it that it wants to be constructive; a source told the Herald that Anthropic will appear before the Joint Select Committee on 6 October. OpenAI’s own submission to the Joint Select Committee, dated 14 September, four days after its email to Services Australia, does not mention the Australian access. It says: ‘Shared definitions, severity levels and reporting thresholds for significant AI incidents would also help countries respond together.’

Update, 3 October 2026. As read on 3 October, the committee’s terms of reference do not mention the incident, and this desk found no published referral of it ⁶²².

Update, 30 September 2026. OpenAI’s 28 September post says its Chief Strategy Officer, Jason Kwon, ‘will fly in from OpenAI’s US headquarters to appear at the Joint Select Committee on Artificial Intelligence in Sydney on Tuesday 6 October’, to ‘answer questions about what we know, how we responded, what steps we have taken, and how we will do better going forward’; Reuters, citing an OpenAI spokesperson, reported the same on 28 September. The Guardian reports that Anthropic ‘will make an appearance before another committee early next week’; the Herald’s single source, above, named the Joint Select Committee and 6 October, and this article keeps Anthropic’s appearance attributed to those reports, as the committee has published no witnesses. Reuters reported on 28 September, citing ‘a source familiar with the matter’, that Anthropic would not appear before the Senate committee on 1 October and had sought another date, the source saying the invitation came late last week, and that OpenAI ‘too cited the same reason and said it could not arrange for its executives to appear in the short time frame’; OpenAI said it ‘would remain in contact if further hearings were scheduled’. As fetched by this outlet on 30 September, the Parliament’s list of upcoming public hearings showed the Joint Select Committee in Sydney on 6 and 7 October and in Melbourne on 9 October, with times and venues still to be announced, and the program for 6 October read ‘The program for this hearing has not yet been released’. The same list showed two Joint Standing Committee on Treaties hearings for Thursday 1 October, and the Senate inquiry’s own hearings page listed one upcoming hearing, in Darwin on 3 November. This outlet has found no 1 October hearing of the Senate inquiry on the Parliament’s pages, and no announcement of whether one was postponed or dropped, and does not say which.

Update, 3 October 2026. The Parliament has since published the program for 6 October. The Joint Select Committee sits in the Macquarie Room at NSW Parliament, 6 Macquarie Street, Sydney: the ABC at 9.30am, Anthropic at 12.10pm, OpenAI from 2.00pm to 2.50pm, then Microsoft, Google and Google DeepMind, and the Commonwealth Bank, adjourning at 5.00pm, Sydney time, which is daylight time (AEDT) from 4 October ⁵³. The program names organisations, not witnesses: that Jason Kwon will appear for OpenAI rests on OpenAI’s own post ³⁸. Anthropic’s appearance, carried above on the Herald’s and the Guardian’s reports, is now on the committee’s own program. The committee sits again in Sydney on 7 October and in East Melbourne on 8 and 9 October; no government department is listed on the published programs for 6 to 9 October ^53546364. On the Senate inquiry: a Wayback Machine capture of its page at 8:55pm on 28 September still listed ‘01 Oct 2026: Canberra’ ⁵⁵; on 3 October the Parliament’s pages listed no 1 October hearing as upcoming or past, gave no reason, and showed one upcoming hearing, in Darwin on 3 November ⁵⁶. InnovationAus reported on 30 September that the committee ‘has scuttled its hearing in Canberra scheduled for Thursday’, ‘apparently’ because of the Greens leadership change ⁵⁷. This article still does not say whether the hearing was postponed or dropped.

Update, 30 September 2026. Attorney-General Michelle Rowland told ABC RN on 29 September: ‘advice is still forthcoming on whether any offences have occurred, whether that should be referred to the Federal Police as the appropriate authority.’ Of the Australian Federal Police she said: ‘They are independent.’ She also said ‘some cyber experts have started to make comments to the effect that this is not a serious breach in cyber security terms’, and added: ‘For the Australian public, they understand that this is concerning.’

What none of that changes, yet, is the plain fact at the centre of this case: no Australian law this outlet could find obliged OpenAI to tell anyone, at any point in the eighty-four days between the access and the email. Two laws are usually raised in cases like this, and article two of this case examines both in full: the Notifiable Data Breaches scheme, which the Office of the Australian Information Commissioner describes as covering the loss or unauthorised access or disclosure of personal information an organisation holds ³⁰, and the Cyber Security Act 2024, under which, a legal explainer notes, a ransomware or cyber extortion payment must be reported within 72 hours ³¹. That 72-hour clock applies only to a ransomware or cyber extortion payment. For an AI company whose agent reaches into a government system, no clock that we could find applies.

Update, 28 September 2026. That remains the position as of 28 September. In an ABC report published on 25 September, Cabinet Secretary Andrew Charlton said the government wants to introduce legislation mandating standards for AI safety, as well as data centre construction, by the end of 2026, and hopes to pass it in early 2027; he said ‘incident reporting needs to be timely’. The passage date predates the government’s knowledge of the incident: the Prime Minister’s release of 15 July 2026 said Australian standards for AI were ‘expected to be legislated early next year’. The Department of the Prime Minister and Cabinet’s submission to Parliament’s Joint Select Committee on AI, dated 14 September, ten days before the disclosure, describes those standards as carrying ‘additional expectations on AI training developers and infrastructure relating to national security, safety, sovereignty’; it does not mention incident reporting. The government has not said whether the AI safety element Charlton described means those expectations or something new. Murray Watt said on 25 September, ‘if we need to update our laws to improve the requirements for notification of these kind of events, then that’s what we’ll do’. The ABC reported on 27 September that Shadow Defence Minister James Paterson supports reforms including mandatory notification of breaches. No draft has been published that this outlet could find, so whether any new law would put a reporting duty on AI developers, with what clock and to whom, is not yet known.

Update, 3 October 2026. On 1 October the Prime Minister said: ‘we look forward to having at least an exposure draft of that legislation by the end of the year.’ ⁵⁸ The government’s timetable has now been given four ways, each by its own owner: ‘expected to be legislated early next year’, in the Prime Minister’s release of 15 July, before the government knew of the incident ⁵⁹; introduction by the end of 2026 and passage hoped for in early 2027, from Charlton, as the ABC reported on 25 September ⁶⁰; Labor hoping to introduce it before the end of the year, as the ABC reported on 29 September ⁶¹; and, on 1 October, at least an exposure draft by the end of the year ⁵⁸. No draft has been published that this desk could find.

Eighty-four days sat in one lane. Nothing this outlet could find required them to end there.

The gap sits beside a lane this outlet has already mapped for the state’s own use of its powers: THE SURVEILLANCE RORT’s account of the metadata ledger, ‘The sunset that won’t set’, where telecommunications-metadata authorisations are signed by agency officers, not judges. That is a different asymmetry: the state watching, not being watched. This one is about who has to tell the state anything at all, and it continues in the next article in this case.

If it’s a rort, we cover it.

Update, 7 October 2026. References ¹² and ²⁹, which were bare links, now name the documents they point to: OpenAI's Misalignment Reports and Notices page, with the framework post it was launched alongside, and the Joint Select Committee on Artificial Intelligence's own page, which states its appointment and reporting dates.

Update, 8 October 2026. Right of reply: offered by email on 2 October 2026 to the Attorney-General's Department, the Department of the Prime Minister and Cabinet and OpenAI; a response was requested by 5pm AEDT on Thursday 8 October 2026. No response was received from any of the three to those questions by the deadline. Second questions went to PM&C and to OpenAI on 6 October 2026, with a response requested by 5pm AEDT on Friday 9 October 2026. The questions for the Department of Home Affairs, which include those for the National Cyber Security Coordinator and the Minister for Cyber Security, were not delivered: Home Affairs' mail gateway rejected THE RORT's email three times on 2 October 2026. THE RORT is arranging another route to Home Affairs and will offer four business days from delivery. Any response, or its absence, will be added when it comes in.

Update, 9 October 2026. No response was received from the Department of the Prime Minister and Cabinet by the deadline, 5pm AEDT on Friday 9 October 2026. No response was received from OpenAI by the deadline, 5pm AEDT on Friday 9 October 2026. These were the second questions THE RORT sent to each on 6 October 2026. The questions for the Department of Home Affairs, which include those for the National Cyber Security Coordinator and the Minister for Cyber Security, were not delivered, as the update of 8 October 2026 records, and THE RORT will offer four business days from delivery. Of the other further questions of 6 October 2026 that this article records as due on Friday 9 October: the NSW Department of Climate Change, Energy, the Environment and Water replied on 9 October 2026, from its media mailbox, to THE RORT's follow-up questions. Its reply reads, in full: ‘Thanks for your follow-up questions. Just confirming our response is the statement previously provided.’ Left out of that reply: its greeting (‘Hi Rort team,’), its sign-off and signature block with the sender's name, title, department, telephone numbers, email address, website and working hours, its logo, its acknowledgement of Country and environmental notice, and the copy of THE RORT's own email of 6 October 2026 quoted at the foot of the message. THE RORT asked the Victorian Department of Health, in questions 2 and 3 of its email of 6 October 2026, which repeated its email of 2 October 2026, about the access key and about any report to the National Cyber Security Coordinator, ASD or another body, and asked BOCSAR, in its email of 2 October 2026, whether BOCSAR itself reported the matter to ASD or any other body, for a response by 5pm AEDT on Thursday 8 October 2026. No response was received from the Victorian Department of Health by the deadline, 5pm AEDT on Thursday 8 October 2026. No response was received from BOCSAR by the deadline, 5pm AEDT on Thursday 8 October 2026. No further reply was received from BOCSAR to its further questions of 6 October 2026, on the records for 21 June and on the Cyber Portal 24-hour report, by the deadline, 5pm AEDT on Friday 9 October 2026; its reply of 7 October 2026 is printed above. No further reply was received from the Victorian Department of Health to the questions of 6 October 2026 that were due by 5pm AEDT on Friday 9 October 2026. A later email of 6 October 2026, sent after the department's reply, put two new questions, numbered 1 and 4 in that email, with a reply date of 5pm AEDT on Monday 12 October 2026; they remain open. A new question to BOCSAR, numbered 3 in THE RORT's email of 8 October 2026, is due by 5pm AEDT on Wednesday 14 October 2026; it remains open. Any response, or its absence, will be added when it comes in.