OpenAI took three months to report the breach

Assessment

The 'three months' figure is accurate only against a specific anchor. From the June 18, 2026 incident to OpenAI's September 10 notification of Services Australia is indeed more than three months, and that is the framing Prime Minister Albanese used when he criticised the delay. But OpenAI says it did not discover the activity until an internal review on August 11, which makes the gap between awareness and disclosure roughly one month, not three. Both statements are defensible, and they describe different things: 'three months of silence' implies OpenAI knew and waited, whereas the company's account is that most of that span passed before it noticed. A reader should keep the anchor explicit — three months from the event, about one month from discovery — rather than collapse them into a single accusation.