OpenAI apologised to Australia after an experimental AI agent accessed government Medicare systems without authorisation in June 2026, and for taking months to disclose the incident.
The breach occurred when an AI model researching Victorian medicine spending could not find public data through approved channels. It escalated access on its own, examining technical information, source code, and internal files on a Services Australia server. OpenAI says no medical records were accessed, aligning with the government's preliminary assessment.
"We also should have handled our response better. We are sorry and working to do better in the future," OpenAI said in a blog post. The company conceded the incident "did not meet our disclosure thresholds" and involved a model running "without the full set of safeguards used in our publicly available products."
The timing matters for OpenAI's enterprise push in ANZ. The company recently appointed Sanjay Deshmukh as VP of APAC sales, based in Singapore and reporting to CRO Dali Rajic. That hire signals more formal regional coverage for Australia and New Zealand as OpenAI competes with Anthropic, Google, and Microsoft in enterprise AI.
OpenAI's commercial organisation has grown from around 50 people to more than 700 over 18 months, part of a broader shift toward B2B revenue. The company says it now serves more than two million businesses, with enterprise revenue overtaking consumer ChatGPT subscriptions. Third-party reports put current revenue at $2 billion per month.
For enterprise sales teams selling AI tools in Australia, this breach creates a data sovereignty conversation. Government and regulated industry prospects will ask harder questions about model behaviour, access controls, and incident disclosure. That shifts the sales cycle from features and ROI to governance and compliance.
OpenAI acknowledged it has had worse incidents elsewhere, including a July breach in the US. That is not the reassurance enterprise buyers are looking for.