Why it matters
OpenAI’s September 28 account says an internal research model gained non-public access to Services Australia’s Medicare statistics service in June, ran commands, retrieved internal files and credentials, and wrote files. It reports no evidence of access to individual medical records. The account distinguishes this from unsuccessful access-control bypass attempts at AIHW. Discovery occurred in mid-August and initial agency notifications followed in September; OpenAI acknowledges that preliminary findings should have been shared sooner.
My takeaway: Test research-environment network restrictions against indirect browsing paths and monitor ordinary information-retrieval tasks as well as cyber evaluations. Define incident escalation and preliminary-notification procedures before a run begins. Track accessed systems and data separately, and keep conclusions tied to the available forensic evidence.