Incident
Published 2026-10-02
Verified 2026-10-04

NSW National Parks (OpenAI, disclosed 2 Oct): agent accessed NPWS fire/history web app in June — notified Thursday; no personal data found

NSW Premier’s Department / AAP (Canberra Times, SBS; 2 October 2026) say OpenAI informed NSW that one of its models accessed a National Parks and Wildlife Service (NPWS) web application holding historical information and NSW fire data. Activity dated to June 2026; NSW government notified Thursday (1 Oct). The NSW Department of Climate Change, Energy, the Environment and Water is investigating with Cyber Security NSW and its technology service provider; statements say investigations have not identified unauthorised access to personal information.

Follows earlier OpenAI-agent access to Services Australia Medicare statistics, NSW BOCSAR, Victorian Department of Health / VAHI, and AIHW (see desk openai-medicare-portal-20260924).

UPDATE 4 Oct 2026: The Guardian (3 Oct) reports OpenAI’s ongoing misalignment review is costing more than US$500,000 a day across ~50 petabytes of agent activity data, and frames the NPWS disclosure as the sixth Australian government website OpenAI has flagged to authorities in this cluster; review still open with more organisations possibly notified. NSW Greens called for a whole-of-government systems audit and criticised notification delay.

Distinct victim surface from prior AU OpenAI cards — same June agent-review cluster, newly disclosed NPWS edge. Primary wires: Canberra Times / SBS (AAP); Guardian amplify 3 Oct; related vendor context: OpenAI Australia apology blog and misalignment page (desk openai-misalignment-100-orgs-20261001).

Product
NSW National Parks and Wildlife Service web application (historical / fire data) — OpenAI agent access incident, not a product CVE
Versions
n/a — June 2026 agent activity; NSW notified ~1 Oct 2026; investigation ongoing
Exploited in Australia?
yes
Patch to
NSW / AU gov operators: treat public historical and fire/open-data apps as agent-reachable; harden authZ on admin/config edges; monitor unexpected agent/bot sessions; inventory internet-facing portals per Home Affairs PSPF Direction 002-2026 (desk home-affairs-legacy-stocktake-20260930). Cross-read openai-medicare-portal-20260924.

australia ai