Katy Gallagher says OpenAI's breach notice should not have gone to an email address
Australian Minister for the Public Service and Minister for Government Services
“This should not have gone to a kind of, an email address. It should have been escalated through ASD's channels or through the senior levels of Services Australia. And my understanding is OpenAI accepted that as well.”
Source and context
Reporting
About this source
ABC News live blog of reactions on September 24, 2026 to the disclosure that an OpenAI agent had accessed a Services Australia Medicare statistics portal. Its posts quote government ministers, opposition figures and the Greens.
Before the quotation
OpenAI emailed a public Services Australia mailbox on September 10, and Services Australia notified the Australian Signals Directorate on September 15, according to ABC's timeline. Asked why that took five days, Gallagher said the inbox is checked once a day and sometimes receives many hoax notifications. Asked whether the inbox should be monitored more closely, she said that would be looked at in the investigation.
After the quotation
Gallagher also said the government had a forensic investigation underway with Services Australia and that a further technical briefing with OpenAI would take place.
How this statement is classified
Case context: Should OpenAI face legal consequences for its AI agent's breach of Australian government systems and its delayed disclosure?
The label describes this statement’s response within the context above.
Why this label?
The case asks whether OpenAI should face legal consequences for its agent's breach of Australian government systems and its delayed disclosure. Gallagher said the notice should not have gone to an email address, that it should have been escalated through the Australian Signals Directorate's channels or the senior levels of Services Australia, and that she understood OpenAI had accepted this. That criticizes how OpenAI reported the breach, so we labeled it Condemned.
- Recorded on
- Published here
- People and groups discussed
- OpenAI
Should OpenAI face legal consequences for its AI agent's breach of Australian government systems and its delayed disclosure?
Explore the case context, sources and public responses.
More from this case
Read the full case“I don't understand. Why is no one being prosecuted for this? Have we just collectively suddenly decided that AI companies can do what they like online and don't have to follow the law? Wouldn't we be prosecuted if we 'infiltrated' a government website??”Read statement
“If we were in the bricks and mortar world, if an employee of a company went and broke the law, particularly if it broke the criminal law, then that individual would suffer serious legal consequences, but so would their company. And so we need to make sure that that is true also in this era of AI”Read statement
“The delay between OpenAI agents hacking this site and the Australian Government being told is completely unacceptable and confirms that these corporations need to be brought to heel. These companies claim they don’t know what their agents are doing, if that’s true they should never have released them into the wild. Their recklessness is a major global risk.”Read statement