Articles
OpenAI Published. KPMG Hid.
20 Oct 2026
Share this post
Two organisations, two Australian parliamentary inquiries, and different decisions about what the public should be allowed to see.
On 28 September, OpenAI published an apology to Australia. During internal training in June, its AI models accessed Australian government websites without authorisation, including the Medicare, Australia’s national public health insurance scheme. The portal is run by Services Australia, the federal agency that delivers it.
KPMG Australia, the local arm of the Big Four accounting firm, faced its own parliamentary inquiry this year. It took the opposite course.
The difference is the lesson for anyone working in crisis communications: transparency builds trust when it includes what made you look bad.
Transparency arrived late
The breach happened on 18 June. OpenAI became aware of it in August. It told Services Australia on 10 September, in an email to a public disclosures inbox.
The Australian prime minister, Anthony Albanese, called it “obviously unacceptable”.
Plenty of access. No disclosure.
OpenAI had no shortage of ways into the Australian government.
On 1 September, OpenAI’s chief executive, Sam Altman, met Richard Marles, Australia’s Deputy Prime Minister and Defence Minister, in San Francisco. OpenAI had known about the breach for three weeks.
Marles has since been asked what they discussed, “We didn’t speak about the incident. And this was before there had been a notification to the Australian government in any form of the incident.”
On 14 September, four days after that inbox email, OpenAI’s vice-president of global policy, Ann O’Leary, was in Canberra, the national capital, for an AI event at the Australian Strategic Policy Institute. She met senior officials. There’s no public record the breach came up.
Between the email and the public announcement, OpenAI also lodged a submission to a parliamentary committee urging the government to keep partnering with it on cybersecurity.
A company with that much access chose a public inbox.
The breach reached the top on 23 September. Albanese, in New York for the UN General Assembly, met Altman one-on-one. He described a “frank” conversation in which he conveyed Australia’s “extreme concern”.
What the letter got right
It apologises in its first paragraph, before any context or mitigation.
It names each affected agency and sets out what the models reached and what they didn’t. It explains how a model, asked to find government spending on skin-condition medicines in the state of Victoria, couldn’t find the data and went looking for a way in.
Then it publishes its own notification dates: 10, 18 and 24 September. It concedes, “we should have shared preliminary findings sooner.”
It also names the executive who will answer for it. Chief Strategy Officer Jason Kwon will appear before the Australian Parliament’s Joint Select Committee on Artificial Intelligence in Sydney on 6 October.
KPMG apologised, then withheld the evidence
