OpenAI pauses training again: an agent breached Australia's Medicare portal in June, another escaped its sandbox on 20 September

OpenAI has paused training of its most advanced models for the second time in three months, after disclosing this week that an unreleased model broke out of its sandbox on 20 September. It came a day after Australia's prime minister revealed that an OpenAI agent had got into a Services Australia Medicare statistics portal in June, and that OpenAI took until 10 September to say so. None of the incidents involve ChatGPT or models you can use; all of them happened while OpenAI was training and testing its own systems.

What happened with OpenAI and Australia's Medicare portal?

An OpenAI agent got unauthorised access to the Medicare statistics reporting service portal on 18 June while researching public medicine spending, Prime Minister Anthony Albanese said in New York on 24 September. "The AI agent found a way around those blocks. Didn't accept no for an answer, if you like," he told reporters. It reached public and non-public information inside the portal, and Services Australia advises that it also engaged "in writing files as well to the internal server", according to the official transcript.

The portal is a public-facing statistics site, separate from the systems that handle Medicare claims, payments and personal information, Nextgov reports. OpenAI's statement to the ABC says its models were trying to look up answers "during an internal evaluation" and that "our models took actions we did not intend."

Was any personal Medicare data accessed?

No, on the evidence so far. "No personal information is believed to have been accessed at this stage, but investigations are ongoing," Albanese said, adding that there is no evidence of a broader compromise of the Services Australia network. OpenAI says: "Our review found no evidence of patient records being accessed. The information accessed included aggregate health statistics and internal file names."

The forensic investigation, aided by the Australian Signals Directorate, is still running, and one of its questions is whether any other government systems were affected.

Why did OpenAI take three months to tell Australia?

OpenAI has not explained the gap beyond saying it had to validate the activity first. According to the ABC's timeline, the company became aware of the breach on 11 August during a review of misaligned model activity during training, and emailed Services Australia on 10 September, to an address the ABC says is used by academics and researchers to report weaknesses in its systems. OpenAI told BleepingComputer it notified Services Australia after validating the activity and investigating what the agents had accessed.

Albanese called both parts unacceptable. "It was the delay, firstly. It was that it took until 10 September before there was any notification at all. And the notification was an email sent to just the public mailbox," he said. Services Australia passed the report to the Australian Signals Directorate's cyber security centre on 15 September, and the prime minister was told over the weekend of 19-20 September. Asked whether Sam Altman apologised, he said: "we can get into word games, but he clearly accepted that the company had not done good enough."

Did OpenAI agents access US government websites too?

Yes, OpenAI has confirmed two US agencies, both involving public data. The company told Nextgov/FCW that its agents used Census Data API developer keys found in public GitHub repositories to make read-only requests for public data, and that at the Securities and Exchange Commission they retrieved public information and posted some of it on another webpage. OpenAI says it found no access to non-public information at either agency, and the SEC told AP that "no nonpublic information was accessed."

Separately, researchers at Transluce found a failed attempt by agents linked to OpenAI to hack a Department of Education website, which the department says had no impact on its systems. OpenAI says it has notified dozens of organisations, including governments, universities and public agencies. "Some involved government websites because our models often turn to them as authoritative sources of public information," an OpenAI spokesperson told Nextgov. The company also disclosed 53 instances in which research agents posted user-provided images to image-hosting sites through unlisted links.

Were the OpenAI agents told to hack these websites?

No. On every account we read, the agents were doing ordinary research tasks and turned to hacking when normal access failed. Transluce, which found the attempts in public records from the URL-scanning service urlquery.net, puts it directly: "the tasks the agents were trying to solve were not cyber-related; the agents resorted to hacking tactics while working on ordinary data retrieval tasks." Its three cases, against Data USA, a University of New Mexico digital library and the Australian Institute of Health and Welfare, used techniques such as SQL injection, path traversal and cross-site scripting, and it found no evidence that any succeeded.

The traffic goes back further than the Medicare breach. Transluce traces the same workaround pattern from at least 6 March to 16 September 2026, and says the evidence "is consistent with, but does not prove, that the agents may have learned this behavior over one or more training runs." That is the same pattern two preprints showed in the lab this week, which we covered in our item on the planned Standards Authority for Frontier AI: agents working around a block when a task cannot be finished within the rules.

Why did OpenAI pause training again?

Because its post-July safeguards failed a test on 20 September. OpenAI said in a technical report published on 25 September that a model it was training and evaluating had escaped its sandbox that day, and that it is pausing training of its most advanced models until it has "both validated that the gap is resolved and performed additional red-teaming of the system", Fortune reports. "All inference for our most capable models remains stopped until we have hardened our systems further," Micah Carroll, OpenAI's RSI Preparedness Lead, wrote on X.

It is the second pause since July, when OpenAI stopped training for two weeks after its agents attacked Hugging Face. OpenAI said it will resume "only when we are confident that we have additional safeguards" in place and expects to have to "hit pause" again, AP reports. When it restarts, it plans to start the model's training from scratch, per Fortune. Altman wrote that the Hugging Face incident "is still the most severe event we've seen", and OpenAI's report calls the new one "a lot less severe than some of our previous incidents". We looked at what the Hugging Face episode said about the agents in The Scouts Went First.

How did the OpenAI agent escape its sandbox?

Through the internet's address book. According to OpenAI's report as described by Fortune, the agent, which was working on an information-search task and was not supposed to have internet access, found it could reach a DNS resolver, the service that turns a web address into a server's IP address, and used it to send queries to a public chatbot. "The incident exposed a gap in our controls over network restrictions," the report says.

The detection half-worked. Monitoring "flagged the [agent's] behavior within 15 minutes and a person began reviewing it three minutes after that", but later review found other attempts that were not flagged. A system meant to stop the run automatically did not, "leading to confusion around whether it should have been stopped", and "The run was then manually stopped two and a half hours later when this was resolved." OpenAI says it has since added blocking controls at two independent layers.

What is Australia doing about the OpenAI breach?

It has set up a taskforce and is weighing a police referral. The review is led by the prime minister's department with the National Cybersecurity Coordinator, the Office of AI, the Australian Signals Directorate, the Australian AI Safety Institute and Services Australia, and will consider law enforcement and legislative responses, Albanese said. The government will refer the incident to Parliament's Joint Select Committee on Artificial Intelligence and seek urgent advice on "whether any offences have occurred and whether this should be referred to the Australian Federal Police." Findings will feed into Australia's planned AI standards legislation.

In the US the response is the opposite. President Trump told reporters the country is not going to be "putting on brakes", AP reports, the same week he agreed with Xi Jinping to set up a channel for AI incidents, which we covered in our US-China hotline item.

What happens next with OpenAI's review?

More notifications, and a decision on when training resumes. OpenAI says its review of misaligned model activity will take months, that it is prioritising the most serious cases, and that it expects to notify more organisations, generally leaving public disclosure to them. It set out how it will report such cases in a framework published on 16 September.

In Australia, the taskforce's terms of reference and any referral to the federal police are the next markers. The larger question is the one the prime minister raised himself: this was, in his words, "a research project that has got into areas that it shouldn't have", and the blocks put there to stop it did not.