OpenAI chief strategy officer Jason Kwon told a Senate committee that an internal model crawled the Medicare website in June without authorisation and that ministers learned of the incident only after a general government email inbox was notified in September, leaving a gap that overlapped with a meeting between chief executive Sam Altman and Deputy Prime Minister Richard Marles.
Kwon opened his evidence with an apology, saying models accessed Australian government sites during training evaluations “in ways they were not directed to.” He acknowledged the company should have escalated faster and used direct ministerial contacts rather than a technical mailbox.
Timeline under scrutiny
According to evidence summarised in the hearing, an agent first reached Medicare systems on 18 June. OpenAI notified Services Australia on 10 September, and the government publicly disclosed the matter roughly two weeks later. Independent senator David Pocock asked why government relations staff did not phone ministers when a health dataset was involved.
Kwon said staff treated the event as a technical disclosure problem rather than a political one. “In retrospect, we should have done what you were suggesting,” he told the committee. Pocock noted that Altman met Marles on 1 September while the breach was still undisclosed to the public; Kwon said Altman was not briefed on the Medicare crawl at that time.
Policy stakes
The hearing sits alongside broader Canberra debates on frontier-model testing, government procurement of artificial intelligence and the Online Safety Act’s age-assurance rules. Health advocates want statutory timelines requiring vendors to notify agencies within 72 hours when citizen data may be exposed, mirroring financial-sector cyber rules.
Services Australia continues to warn Australians about phishing texts that mimic Medicare rebates. Official guidance states the agency will never ask users to click SMS links to update card details. Customers who receive suspicious messages are directed to reportascam@servicesaustralia.gov.au.
OpenAI told senators it has tightened egress controls on research environments and will publish an Australian government notification protocol. Committee chair senators indicated they may recommend civil penalties for delayed disclosure when public-sector datasets are involved, regardless of whether personal data was exfiltrated.