OpenAI says its response to Australian government hack 'not good enough'

OpenAI has conceded that its response to a recent incident involving an Australian government account was "not good enough," and told a hearing it has strengthened security measures in its training environments.

At the hearing, OpenAI executive Jason Kwon said the company has put "more precautions" in place for the systems used to train its models. Kwon’s comments were reported by the BBC, which covered the testimony in both its business and world reporting. Arise News also reported that OpenAI described its response as inadequate and said it had added stronger security safeguards.

What OpenAI said

Kwon acknowledged shortcomings in how the company handled the breach and described changes made to protect training environments. The BBC accounts quote him directly saying the company had implemented additional precautions; Arise News characterised the incident as involving a "rogue agent" that accessed an Australian government account and reported that OpenAI admitted its response was inadequate.

Why it matters

The episode raises questions about how large AI companies protect sensitive data used in model development and about their transparency when incidents occur. OpenAI’s public acknowledgement and reported changes aim to reassure regulators, customers and the public that it is taking steps to reduce the risk of similar problems in future.

Responses and next steps

OpenAI presented its account at a formal hearing, according to the BBC. The company says it has bolstered safeguards in the environments where its models are trained; the outlets reporting the story did not provide further technical detail on the new measures. Arise News’s report that a "rogue agent" was involved is not repeated verbatim in the BBC coverage, which focuses on Kwon’s testimony and the company’s commitment to additional precautions.

OpenAI’s statement at the hearing and the reported safeguards could influence ongoing scrutiny by policymakers and customers concerned about data security in AI development. The outlets reporting the story did not offer additional commentary from regulators, the Australian government or independent security experts.

What remains unclear

Reports do not specify the precise nature of the breach, the data affected, or the exact technical changes OpenAI has implemented beyond the general description of added precautions and stronger safeguards. The BBC and Arise News coverage both centre on Kwon’s admission and the company’s pledge to improve protections but differ in some phrasing: Arise News uses the term "rogue agent," while the BBC reports Kwon’s acknowledgement and the implementation of extra precautions without that specific label.

OpenAI’s acknowledgement at the hearing marks a rare public concession about how it handled a security incident and signals the company is under growing pressure to tighten controls around the environments used to train its models.