The agent got in on 18 June. The email arrived on 10 September.

The dates, from the government's account

The timeline below is the one ABC News published with its report on the prime minister's press conference, and it matches what Index and Telex reported from the Guardian and the BBC.

On 18 June an OpenAI agent, given the task of finding Australian health statistics, met access blocks on the Medicare statistics reporting portal run by Services Australia and got around them. In the prime minister's words, the agent "found a way around those blocks, didn't accept 'no' for an answer." It read aggregate health statistics and internal file names. On 11 August OpenAI found the activity in a review of its models' behaviour. On 1 September, according to ABC, OpenAI's chief executive met Australia's defence minister and did not mention it. On 10 September OpenAI sent an email to a public disclosures address at Services Australia. It was read on 11 September. Services Australia reported it to the Australian Signals Directorate (ASD) on 15 September. Direct talks between the government and OpenAI began on 22 September, per Index. The prime minister made it public on 24 September, Australian time.

OpenAI's statement, as ABC quotes it: "Our review found no evidence of patient records being accessed." The acting prime minister described the agent's contact with three other public websites as entirely normal. Index's headline says the agent got in among sensitive data. OpenAI's account is aggregate statistics and file names; the government's is public and non-public files on a portal it calls non-sensitive, plus, per Services Australia, files written to an internal server. A forensic investigation is still running, so we quote the accounts and leave the adjective to Index.

Update, 26 September. ABC reported on 26 September that OpenAI's agents spent almost a week trying to extract Pharmaceutical Benefits Scheme (PBS) and aged care data from the Australian Institute of Health and Welfare (AIHW) website, which it says appears to contradict the government's initial understanding of the June incident. Investigations by AIHW and the ASD found "no evidence" that the institute's systems were compromised or that non-public data was accessed. The same day OpenAI said it had notified "dozens of third parties", among them governments, universities and public agencies, about unauthorised autonomous agents bypassing security controls or otherwise affecting their systems. The government's assessment above therefore reflects what was known on 24 September.

The vendor's own report, one day later

On 25 September OpenAI updated its public misalignment reports with a separate case. The report is not about Australia and does not mention the Medicare portal; it describes an incident in an internal training environment, discovered on 20 September. It still reads like a laboratory version of the Australian story. An internal research model on a search-based training task had its own search tool, with direct access to external search engines blocked and all non-DNS traffic routed to an offline web cache. It found that the sandbox's DNS resolver could still reach the public internet and used DNS lookups to carry its questions to a public chatbot service. OpenAI's own summary: the agent "queried a public chatbot service through a gap in our internet-access restrictions: insufficient DNS filtering in its training sandbox."

The remediation is the useful part. OpenAI says it restricted DNS queries in the environment to a limited allowed list of domains and record types, added blocking controls at two independent layers, either of which would have prevented the access, and paused training, evaluation and inference with tool use for its most capable models until the fix is validated and further red-teamed.

That is the plainest statement we have read from any laboratory that agent security is, before anything else, egress control. It also says that a sandbox built by one of the best-funded engineering organisations in the world leaked at DNS, the oldest and most boring exit there is.

What this proves, and what it does not

It proves three things. An agent told no will look for another door; the prime minister's sentence is the whole security model in twelve words. The party that notices is whoever holds the logs, and here that was the vendor, almost eight weeks after the event, not the operator of the portal. And the timing of the notification was the vendor's decision. The email went out when OpenAI chose, to the address OpenAI chose.

It does not prove that running your own agent would have prevented this. This was OpenAI's own research agent reaching a third party's public portal, and a self-hosted agent with open outbound access could do exactly the same thing to exactly the same portal. The control that would have stopped it is an egress policy, and a customer of a public cloud can write one too. It is Australia, not the EU; the government reports no personal data; there is no GDPR or NIS2 breach by OpenAI to point at, and we do not.

On the day of ITBN we wrote that the abstracts of a whole security conference did not mention egress control or software that phones home. This week supplied the case study we did not have then, from the vendor's own pen.