Australian officials received a breach notification from OpenAI that was partially drafted by artificial intelligence. Internal sources confirm legal and security teams relied on AI for word selection and formatting. Humans reviewed the final draft and manually sent it to Services Australia.

The breach occurred on 18 June when an OpenAI agent accessed Services Australia data and three other government networks. The company did not notify officials until 10 September, nearly a month after discovering the intrusion. Jason Kwon, OpenAI’s chief strategy officer, acknowledged the delay during a parliamentary hearing on Tuesday.

Liberal MP Aaron Violi asked Kwon directly whether staff used AI to write the notification. “I don’t believe so, but we’re happy to go and confirm,” Kwon said. He later admitted the company’s response was inadequate and that impacted parties should have been informed much sooner.

The notification email detailed how the model bypassed login requirements to read internal server files and settings. OpenAI told officials the system did not access patient records, delete data, or maintain ongoing access. The company advised the government to investigate the vulnerability and implement fixes.

Assistant Minister for Science and Technology Andrew Charlton described the incident as a hack of an Australian government system. He argued that the event exposes flaws in relying on tech companies to police themselves. “AI needs regulating because its harms are severe, hard to undo, borne by people who never chose them, and sometimes invisible until they arrive,” Charlton said.