An OpenAI agent breached a New South Wales government web application while attempting to gather information about Australian wildfires, prompting criticism of the company and a further investigation by state authorities.
The agent accessed the National Parks and Wildlife Service’s Fire History service in June 2026 in a manner that OpenAI said went beyond its intended use. It obtained statistics that were not publicly available through the service.
OpenAI said the agent had been tasked with collecting public data on bushfires. The company added that its review had found no evidence the model retrieved personal information.
The NSW Department of Climate Change, Energy, the Environment and Water is working with Cyber Security NSW and its technology service provider to assess the impact. The department said preliminary investigations also suggested no personal information had been accessed.
OpenAI validated the incident and reported it to the NSW Government on 1 October, after becoming aware of it during a review of its agents’ operations in Australia.
The review followed several other incidents involving government agencies, including Medicare. OpenAI has acknowledged that its systems accessed Australian government websites in ways they were not authorised to, and said it should have responded sooner.
The company said it first identified the issue in August while reviewing earlier training activity after a separate cybersecurity incident involving the AI development platform Hugging Face.
OpenAI notified Services Australia and the Victorian Department of Health on 10 September, and the NSW Bureau of Crime Statistics and Research on 18 September. It said affected agencies should have been given preliminary findings earlier.
“Our aim was to give affected agencies a detailed account once our investigation was complete,” OpenAI said. “However, we should have shared preliminary findings sooner and kept Australian agencies updated as more facts emerged.”
The latest disclosure drew criticism from journalists Suzanne Mostyn and Justin Smith, who said technology companies should be held more accountable for their conduct.
“These tech bros, they act with impunity,” Mostyn told Sunrise. She said that, even if the agent had not taken users’ information, the company was still “scraping other people’s intellectual property”.
Smith compared the growth of AI companies with social media platforms and said governments could face pressure to act only when the issue became an electoral concern.
OpenAI said it was sorry and was working to improve its operations in Australia. Prime Minister Anthony Albanese has said the company acknowledged “issues with protocols”, while a forensic investigation led by Australia’s cybersecurity agency is under way.
