On June 18, an OpenAI model running one of the company's own internal tests broke into an Australian government website. The site belongs to Services Australia, the agency that runs Medicare (Australia's public health insurance), and it's where the government publishes statistics on health spending. The agent got past the site's restrictions. Anthony Albanese, Australia's prime minister, said it "found a way around those blocks, and didn't accept 'no.'" It pulled some material the public can see and also some it can't, things like summary statistics and internal file names. OpenAI says it found "no evidence of patient records being accessed." Richard Marles, the deputy prime minister, said the site "was not sitting behind a particularly high fence."

So, no sensitive data taken, a low fence, but still the first known case anywhere of an AI agent breaking into a government system on its own. Marles called it "a warning about the technology being developed without safeguards and without guardrails."

What turned this from a story about AI into a story about OpenAI is everything that came after.

OpenAI discovered what its model had done on August 11. On September 1, Sam Altman met Marles in San Francisco; Marles says the breach "wasn't the subject of that meeting," and that he doesn't know what Altman personally knew at the time. On September 10, OpenAI sent an email to [email protected], the address researchers and academics use to report website vulnerabilities. That was the notification, 84 days after the initial breach. Services Australia then passed it to the country's cybersecurity agency five days later.

Then, on September 23, Albanese spoke to Altman and told reporters at the UN of his "disappointment that it took the company way too long to inform the government what had occurred and the way that that notification occurred as well was unacceptable." His finance minister, Katy Gallagher said, "this should not have gone to an email address, it should have been escalated."

Albanese and Marles both said the breach itself was serious, and they meant it. But when it came time to say what OpenAI had done wrong, every word was about how they were told. 'Way too long.' 'An email address.' 'Should have been escalated.' So yes the model gave them a reason to worry but it was the notification process that gave them a reason to be angry.

It's also worth being clear-eyed about why Australia said any of this out loud. The BBC's Sydney correspondent laid it out saying that this is a government positioning itself as the country that stands up to big tech, it happened to be at the UN General Assembly that week, and because nothing sensitive was taken, going public carried almost no risk. A former government cyber adviser told the BBC he'd heard that other governments have received similar notices from OpenAI and chose to stay quiet. Treat that as the rumor it is but if it's even partly true, it means OpenAI's notification process here wasn't unusual.

It’s a good example of the fact that you never control whether the other side wants to go public. You just control what you give them when they do.

Your notification is your crisis response.

The channel you pick and the seniority of the person who picks up the phone are a message in themselves, and the other side reads that message as a measure of how seriously you take them. An email to a general inbox says, this is routine to us and also not really our problem. A call from a senior executive to a minister says, we know what this is and we also care about our relationship.

These decisions rarely get treated as reputation decisions, because they don't look like one at the time. A breach found by a safety review is handled as a security matter, and security matters get reported through security channels. Nobody is wrong, exactly. But the person choosing the channel is thinking about the vulnerability, not about how a government will feel when it learns, months later, that this was the courtesy it received.

And if your company is putting AI agents to work, look at this as a preview of your own file. The question isn't only who calls the government when your security team finds something. It's who calls when your agent is the one that did it. Most companies deploying agents haven't asked that yet. OpenAI, which builds them, obviously hadn't either.

Now, on the same day Albanese went public, Altman addressed the UN Security Council and said: "We need accurate and speedy incident reporting, classification and reporting protocols, so the world can learn from failures before they become catastrophes." He's right. And he said it while the only notice Australia had received was an email to a public inbox, 84 days late. Every government that deals with OpenAI from here now knows to ask the two questions Canberra asked: what day did you tell us, and how.

Altman's UN message will follow OpenAI for years, and that's fair. But I'd put it next to something else he said this month to Fortune about why the public doubts OpenAI's priorities: 'I think that means we've done a bad job of communicating, and that's on us.' Both sentences are true, and both were said by a CEO whose company hasn't had a chief communications officer since January. I don't think that's hypocrisy, I think it's what taking responsibility sounds like when nobody has been given the responsibility. The more useful question is whether that person will be allowed to build a new rulebook that says if an incident involves a government, the security team calls the people who manage that relationship first.

The best marketing ideas come from marketers who live it.

That’s what this newsletter delivers.

The Marketing Millennials is a look inside what’s working right now for other marketers. No theory. No fluff. Just real insights and ideas you can actually use—from marketers who’ve been there, done that, and are sharing the playbook.

Every newsletter is written by Daniel Murray, a marketer obsessed with what goes into great marketing. Expect fresh takes, hot topics, and the kind of stuff you’ll want to steal for your next campaign.

Because marketing shouldn’t feel like guesswork. And you shouldn’t have to dig for the good stuff.

Sign Up Free