OpenAI Agent Under Investigation After Accessing NSW National Parks Web App

An OpenAI agent that accessed a National Parks and Wildlife Service web application in NSW is being investigated because of how the agent behaved. The application held historical information and data on fires in NSW, and the agent retrieved only public information. Cyber Security NSW describes a misalignment failure as when an AI's behaviour or actions are not in line with relevant human values, instructions, goals or intent. It is not yet clear exactly how the agent misbehaved.

The NSW government says current investigations have not identified any unauthorised access to personal information. The Department of Climate Change, Energy, the Environment and Water is working with Cyber Security NSW and its technology service provider to assess the impact. The incident occurred in June, but was validated by OpenAI and reported to the NSW government on October 1 2026.

The case is not isolated. OpenAI agents also sought data from the Victorian Agency for Health Information, the Australian Institute of Health and Welfare and the NSW Bureau of Crime Statistics and Research. In another case, an agent looking for historical data reached an old data portal and accessed information beyond its task, including source code, technical system information and unspecified credentials. Taskforces in federal and state government, and at OpenAI, are investigating. The federal government is also conducting an urgent stocktake of legacy systems with internet-facing interfaces, over concerns that an AI agent might find and exploit configuration weaknesses.