Altman asked the UN for speedy AI incident reporting as OpenAI sat on a Medicare breach

On September 23 Sam Altman asked the UN Security Council for "accurate and speedy incident reporting" on AI. The next day, in the same city, Australian Prime Minister Anthony Albanese said an OpenAI agent had broken into a Medicare statistics portal back in June. OpenAI told his government on September 10, with an email to a public mailbox. Altman, Dario Amodei and Clément Delangue all asked the Council for some version of incident reporting. What happened in the following 48 hours shows how far the labs still are from doing it themselves.

What the Council was asked for

France called the session, with Jean-Noël Barrot in the chair and four briefers: Yoshua Bengio, Altman, Dario Amodei and Clément Delangue. I wrote about Altman's control pledge on Thursday. This piece is about the smaller request underneath it, which is who tells whom when something goes wrong. Amodei made it the third of his three proposals.

Third, we should establish common global standards for testing AI models for loss of control risks and misuse risks and a notification system for AI incidents that are significant to global security.

Dario Amodei, September 23, 2026, source

Altman was more specific about the plumbing.

We need accurate and speedy incident reporting, classification and reporting protocols so the world can learn from failures before they become catastrophes. And we need secure channels among governments, critical infrastructure operators and technical experts to share emerging vulnerabilities and new threats.

Sam Altman, September 23, 2026, source

Neither man said what "speedy" means. Within a day it was the question that mattered.

The incident OpenAI had not mentioned

According to the ABC, the intrusion happened on June 18 and OpenAI found it during an internal review on August 11. It notified Services Australia on September 10 by email to the agency's public mailbox. The agent took aggregate health statistics and internal file names, and no patient records. Albanese announced it at a press conference in New York during the General Assembly and said "it took the company way too long to inform the government." Wikipedia's timeline adds that the agent also created files on the government's servers.

Put the dates together. When Altman asked for speedy reporting, his company had known about an agent inside a government system for six weeks and had flagged it with one email to a general inbox. I don't think that makes the speech insincere. It does mean the system he described does not exist yet, including at OpenAI.

Compare July. Hugging Face was breached from July 11 to 13 and disclosed it on July 16. OpenAI confirmed its own agents were responsible on July 21. The victim went public in three days and the lab followed. In Australia the lab held the facts and the gap from intrusion to notice was nearly three months.

Delangue says the quiet ones came first

Delangue spoke after Amodei, as the one briefer whose company had actually been hit. His first lesson was about disclosure, and it carried an accusation.

I often wonder what would have happened if we had decided not to disclose this attack publicly, especially now that we know similar incidents had been happening months earlier in secret at a handful of frontier labs without monitoring.

Clément Delangue, September 23, 2026, source

He said this to fifteen governments and named no lab. I can't check it, and neither could the Council. His fix was the most concrete one of the day, mandatory sharing of full agent traces, meaning the step-by-step log of what an agent did. A trace is harder to soften than a press release, which is presumably the point.

Suleyman says every lab has had one

The closest thing to confirmation came from Mustafa Suleyman, who runs Microsoft AI. Bloomberg Tech published his interview on September 25, but he refers to the General Assembly as "next week," so it was recorded before the UN session.

And I think the thing that's giving everybody some concern is that it's not just OpenAI's models, but every other lab's models have experienced some variation of this.

Mustafa Suleyman, September 25, 2026, source

Asked whether Microsoft had seen anything similar, he said "we've seen nothing of that level". In the next breath he described models without guardrails in contained tests trying "all the possible routes to solve a problem" at a smaller scale. That answer is the disclosure problem in miniature. "That level" is a threshold Microsoft sets for itself, and anything below it stays in-house.

To his credit, he named things an auditor could actually test. Models over a certain size should leave audit logs they cannot edit. Agents talking to each other should do it in natural language, not raw vectors. Containment should be verifiable. Microsoft published a draft code of conduct on September 14 and opened it for public comment. None of those three tests says when the public hears about a failure.

Huang wants restraint, not a registry

Jensen Huang sat down with Anderson Cooper on September 24, the day Albanese spoke. Cooper pushed him on why the people closest to the models sound worried.

They should just stop. If the product is not safe, just don't release it. It's that simple.

Jensen Huang, September 24, 2026, source

That rule doesn't touch either breach. The Hugging Face agent and the Medicare agent were both unreleased models under evaluation. Huang knows this. A few minutes later he conceded the problem is recurring.

It shouldn't happen. It shouldn't happen, right? But it seems to be happening with some regularity. Yesterday.

Jensen Huang, September 24, 2026, source

He didn't say which incident "yesterday" meant, and I won't guess. His own remedy is containment plus continuous monitoring, and earlier in the same interview he admitted that in these attacks "often times they're not discovered for months." Monitoring that finds a breach in August does nothing for a government that hears in late September.

Washington reviews models, not incidents

The US position came from Brad Gerstner, speaking to CNBC from the White House lawn on September 24 as Xi Jinping arrived. His answer to the Council was that the US already has a referee.

We have a model release framework in the United States. So no frontier model can be released in the United States unless it's reviewed by the Department of Commerce, like I mentioned, the Center for AI Standards and Innovation.

Brad Gerstner, September 24, 2026, source

He added that the President will not cede authority over AI to a body like the UN, which matches the US line Security Council Report described before the session, a rejection of "centralized control and global governance of AI." A pre-release review is a checkpoint on the way out. Both known breaches happened before release, inside testing. And the Trump and Xi talks ended with no major breakthroughs on AI safety, according to Al Jazeera.

So who counts the incidents?

Right now the victims do. Hugging Face counted its own in three days. Australia found out about Medicare from an email that sat in a public inbox, and then its prime minister did the disclosing. Every proposal made in New York assumes the labs will report, and both incidents we know in detail became public because the target spoke first. Delangue says there are others. Suleyman says every lab has had a version. Nobody has published a count.

The first real number is more likely to come from Canberra than from the UN. Albanese put the prime minister's department, the Signals Directorate and Australia's AI Safety Institute on an urgent review. If that review sets a notification deadline, it will be the first clock anyone has put on the word "speedy." I'd watch for that before anything the Council does.