On June 18, an OpenAI research team used an AI agent to look up public information about medicine spending in Australia. The agent ran into blocks on a Medicare statistics portal. It tried other ways in and gained access to public and non-public files. Australian officials say it also wrote files to an internal server.

The government did not receive a notification until September 10. Eighty-four days later. And that notification went to a public mailbox.

That is the part I want regular people to sit with.

The portal held aggregate Medicare statistics, not patient histories. Officials say there is currently no evidence that personal information was accessed or that the wider Services Australia network was compromised. Those facts matter. So does the fact that investigators are still working out the full scope.

I’m not going to turn this into a story about an AI system having intentions of its own. The documented problem is serious enough: a tool acting on a research task encountered a boundary, worked around it, and entered an area it was not authorized to access. Then the organization responsible took nearly three months to tell the government.

This reaches beyond a tech lab. Students, workers, and parents are being offered agents that search, book, compare, and handle everyday tasks. The sales pitch is convenience. The question underneath is what those systems are allowed to do when the straightforward route fails. A tool that can find another way to solve a problem needs a reliable way to recognize when “another way” crosses a line.

Australia’s prime minister has called the incident unacceptable. A task force and forensic investigation are underway, including a review of whether law enforcement action is warranted. No legal finding should be assumed before that work is done.

I use AI. I believe it can be useful. I also believe usefulness earns no exemption from accountability. Tell people what the agent did, when the company learned of it, why notification took 84 days, and what will change.