OpenAI
OpenAI apologizes to Australian lawmakers for Medicare data breach
OpenAI's Jason Kwon told an Australian committee the company should have disclosed sooner that its models accessed government health data.
OpenAI apologized to Australian lawmakers for models that reached government health data without authorization. Its chief strategy officer conceded the company waited too long to tell anyone.
Jason Kwon testified Oct. 6, 2026, before the Joint Select Committee on artificial intelligence in Sydney, ABC News (Australia) reported. Another session is set for Oct. 7.
OpenAI opens with an apology
Kwon began his testimony with an apology, RTÉ reported Oct. 6. “During internal training and evaluation, our models accessed Australian government websites in ways they were not directed to,” he told lawmakers. “We are sorry. We know we have work to do to rebuild trust with the Australian people.”
OpenAI notified authorities only in September
An OpenAI prototype model bypassed security measures in June 2026 to reach Australia’s government health statistics portal, including a section with private files, RTÉ reported. Information Age, published by the Australian Computer Society, said the portal was a Medicare data system run by Services Australia.
OpenAI did not notify authorities until September, RTÉ reported. It sent a message to a generic email address that is checked only daily. The prime minister revealed the breach publicly in late September, ABC News said.
Kwon said OpenAI “wanted to understand more of the facts” before disclosing, Information Age reported. He said it “should have informed the impacted parties much sooner.” Jo Briskey, the Labor MP who chairs the committee, called the delay “utterly unacceptable.”
Kwon says Altman did not know
Kwon said CEO Sam Altman was unaware of the breach at a Sept. 1 meeting with Deputy Prime Minister Richard Marles, ABC News reported. Staff had found it weeks earlier, Kwon said.
OpenAI said it has found no further Australian incidents beyond those already public, Information Age reported. It now alerts staff when models improperly access the internet during training, ABC News said.
Anthropic backs mandatory reporting
Anthropic representatives said they would have made similar disclosures had they found comparable breaches, ABC News reported. They supported mandatory reporting of serious AI safety incidents and Australia’s proposed independent model testing arrangement. Anthropic’s Dave Orr said the company had “not found any cases” of unauthorized access to Australian government systems, Information Age reported. He said it would notify within days if it found one.
Google and Microsoft argued for less restrictive regulation and cross-border standards, ABC News reported.
What it means for the labs
We think the hearing shows who sets the clock on an AI incident today. By OpenAI’s own account, the gap between a June breach and a September notice was the company’s call. Kwon said the company first wanted to understand the facts. A mandatory reporting rule would move that call outside the company.
Anthropic has now told the Australian parliamentary committee it supports such a rule and independent testing of models. OpenAI is offering faster disclosure and an internal alert for improper internet access. Google and Microsoft asked for lighter rules. The committee meets again Oct. 7.