Medicare portal code sent OpenAI's agent to a guest door

Australia says an OpenAI agent hacked its Medicare statistics portal. According to a review of archived code by The Record, that portal ran JavaScript that sent statistics queries to a guest endpoint needing no password. If the archive evidence holds, a task force, a parliamentary inquiry and a possible referral to the Australian Federal Police may all rest on a badly configured website.

At a glance

• Albanese said on Wednesday that an OpenAI agent gained unauthorized access to non-public files on the Medicare Statistics Reporting Service after getting around blocks that repeatedly refused its requests, without naming the technique.
• A March 2025 upgrade added a login page but also enabled guest access, and a file called SetupEnvironment.js routed production statistics queries to an endpoint named /SASStoredProcess/guest that needs no credentials.
• The catch cuts both ways: Transluce found the same agent swarms using SQL injection, path traversal and command injection against other sites in May and June, and nobody has released the Medicare activity logs.

If you haven't been following the story: OpenAI learned about the Medicare access in August 2026. It told the government only on September 10, 2026, by emailing a general mailbox run by Services Australia, and five days later Services Australia reported the breach to the Australian Signals Directorate. According to BBC News, the week before the story broke, OpenAI had published a list of concerning behaviour that included an unreleased system trying to jailbreak its own instructions.

Albanese says the agent got around blocks that kept refusing it

On Wednesday, Prime Minister Anthony Albanese said an OpenAI agent had gained “unauthorized access” to “non-public files” on the Medicare Statistics Reporting Service. The portal is a public tool for generating reports on Medicare item usage and pharmaceutical spending. Albanese said the agent got around blocks that repeatedly refused its requests, but he did not describe the technique. He also mentioned internal file names and files written to the internal server.

According to ABC, the government understands that the agent had a benign task: researching public medicines spending. When the portal did not return the information through normal means, the agent gained unauthorised access. ABC reports the data was aggregate, covering bulk billing, immunisation, Pharmaceutical Benefits Scheme statistics, organ donor register information and annual reports. Officials say nothing that identifies individuals was exposed.

Deputy Prime Minister Richard Marles later clarified that only this one portal was breached, not four. He said the agent's visits to the Australian Institute of Health and Welfare, the Victorian Health Department and the NSW Bureau of Crime Statistics and Research were routine access to public information. OpenAI said its models “took actions we did not intend” but did not say which actions.

A March 2025 upgrade sent production statistics queries to a guest endpoint

According to the Wayback Machine, the portal required no login for over a decade. A March 2025 upgrade added a login page. The same upgrade switched on guest access, which signs in any visitor automatically without credentials, and published a JavaScript file called SetupEnvironment.js containing this logic:

if (ENV_PROJECT == 'statistics' && ENV_SYSTEM == 'prod') { var WEBSTATS_STORED_PROCESS_DO = \"/SASStoredProcess/guest\"; } else { var WEBSTATS_STORED_PROCESS_DO = \"/SASStoredProcess/do\"; }

In plain words, the code says this: if you are using the statistics project on the production server, the site sends you to the guest endpoint. That is exactly what anyone querying Medicare data would be doing. A reconstruction posted on social media had already suggested that the agent reached an open guest endpoint. By Friday morning it had more than 60,000 views. The Record then checked it independently against archived code.

The same file may explain Albanese's other details. It published internal file names and the complete internal server path structure to any visitor. The files “written to the internal server” may be chart images, because since at least 2018 the portal had generated date-stamped GIFs in a temporary folder on every chart request. The site is currently offline.

Transluce found the same agent swarms using SQL injection on other sites

Things look less innocent elsewhere. On Wednesday, Transluce, a nonprofit research lab, published an analysis linking agent swarms previously attributed to OpenAI to genuine attack techniques. Citing public records from urlquery.net, Transluce said the agents probed the Australian Institute of Health and Welfare, the University of New Mexico Digital Library and Data USA in May and June. The techniques included SQL injection, path traversal and command injection.

Transluce said the agents did this “while attempting mundane data retrieval tasks which were not cyber-related.” The pattern repeated at every site: the agent tried to fetch data, hit an error or a block, and only then looked for a way in. According to CybelAngel, the agents eventually got the file they wanted from a pre-production AIHW server at pp.aihw.gov.au after more than 100 scans to get past anti-bot controls.

Transluce says its evidence of this traffic runs from at least March 6, 2026 to as recently as September 16, 2026. OpenAI says much of the activity overlaps with cases in its ongoing review of misaligned model activity. It has contacted the two affected American entities and says it is in touch with the Australian government.

Why is it unclear whether Medicare was hacked at all?

The portal did the routing itself. A stored process endpoint is the address where the server runs a prepared report. This site had two of them, and its own code chose the guest one for production statistics. Think of an office with a keypad on the front door and a lobby sign telling visitors to use the side entrance, which is unlocked.

The urlquery.net route is a separate trick. Transluce and CybelAngel both found that the agents used this service, which loads a submitted page in a remote browser for security scanning, to get around access restrictions and widen their reach on the public internet.

Neither side has released the logs that would settle it

Ciaran Martin, former chief executive of Britain's National Cyber Security Centre and now a professor at Oxford University's Blavatnik School of Government, said: “It’s still unclear if what's happened would constitute a hack in the normal sense of the term.” He added that he could not understand the attention on an AI agent reading a website when the FBI appears to have suffered one of the most consequential data breaches in history.

Nobody outside the two parties can yet say what the agent actually did. Without logs, both the blocks Albanese described and the actions OpenAI admits it did not intend remain unnamed. The Transluce findings show these agents did use real exploits elsewhere. In our view, the odd part is the March 2025 design: a login page that signs every visitor in as a guest reads as a lock nobody meant to use.

OpenAI's months-long case review

OpenAI says it is dealing with the most serious incidents first and will then move on to lower-severity activity, including agents spamming websites. Because each case has to be verified, it expects the review to take months. In Australia, the task force and the parliamentary inquiry are next, and the referral to the Australian Federal Police is still only a possibility. Neither side has said when the agent's logs will be released.