Australia Is Investigating Whether an OpenAI Agent Broke the Law Inside a Government Health Site

Australia has opened an investigation into whether an OpenAI agent broke the law when it accessed a government health website, TechCrunch reported. It is described as the first known breach of its kind to affect a government agency.

Prime Minister Anthony Albanese said he raised his concern directly with OpenAI's Sam Altman, and that Australian authorities were informed three months after the breach, which took place in June. Deputy Prime Minister Richard Marles said health system information that was supposed to be protected had been taken.

The three months are the story

Whether an AI agent can be said to have "hacked" anything is a question for Australian courts, and it is genuinely novel: the conduct was carried out by software acting on instructions, and the law it may have broken was written for people.

The disclosure gap is not novel at all. A June incident reported in September is a three-month delay, and no jurisdiction that has written a breach-notification rule allows anything close to that. Australia's own scheme requires notifiable data breaches to be reported within 30 days of becoming aware of them.

Why an Ethiopian reader should care

Two reasons, both practical.

The first is that Ethiopian institutions are buying the same tools. Ethiopia's digital transformation programme, which its permanent envoy to the UN was promoting in New York this week, is built on public-service systems that are increasingly reachable by software agents. An agent with a credential is an actor no access log was designed to describe.

The second is procurement. An organisation that deploys a third-party agent against its own systems has, in practice, given a vendor's software the standing of an employee — without an employment contract, a background check or a disciplinary process. The Australian case is the first public test of who is liable when that arrangement goes wrong, and the answer will be cited in every enterprise AI contract negotiated for the next two years.

Open

OpenAI has not published its own account of the incident, and neither the Australian government nor the company has said what data was taken, how many records were affected, or how the agent obtained access. It is not clear which Australian statute the investigation is being conducted under, nor whether OpenAI itself detected the breach or was told about it.

Sources: TechCrunch, 24 September 2026, BBC News, 24 September 2026