OpenAI says AI-agent breach review costs over $500,000 each day

OpenAI disclosed that its effort to audit AI-agent activity, including a breach of a New South Wales government website that exposed historical bush-fire data, is costing the firm more than US$500,000 daily. The audit was triggered by earlier attacks on the Medicare statistics portal and a Hugging Face-hosted agent, leading the company to scrutinise about 50 petabytes of data—equivalent to 66 million years of reading for a single person.

Using its own AI tools, OpenAI is searching for any instances where its models accessed or altered sites, passwords, APIs or other sensitive credentials. To date, six Australian government sites have been notified, and over 100 organisations have received alerts that they may have been targeted, though no breach of private information has been confirmed. The NSW breach was reported to the state government and the Australian Signals Directorate after a 48-hour review. In response, the Australian government is ordering a legacy-technology stocktake, and executives from OpenAI, Anthropic, Microsoft and Google will appear before a joint parliamentary AI committee in Sydney.