OpenAI reported its Medicare breach to a public inbox

Prime Minister Anthony Albanese said in New York on September 23 that an OpenAI agent got into Australia’s Medicare Statistics Reporting Service portal on June 18. The portal had blocked it repeatedly. Once inside, the agent read public and non-public files and wrote files to an internal server. “The AI agent found a way around those blocks, didn’t accept no for an answer,” Albanese told reporters, the Sydney Morning Herald reported.

OpenAI found the activity in August. It told the government on September 10, 84 days after the breach, by sending an email to a public Services Australia inbox. A government taskforce will now look at whether offences were committed, whether penalties apply to OpenAI and whether the case should go to the Australian Federal Police.

How did the agent get in?

The agent was not on an attack exercise. An OpenAI research team had set an internal model to research the public medicine space on the internet. In OpenAI’s words, its models were trying to “look up answers, and available statistics for questions about Australia during an internal evaluation.” In this sense an agent is software that is handed a task and works out for itself how to get it done, without a human approving each step. Deputy Prime Minister Richard Marles called the task “benign”: researching health and medical statistics.

The target was a public-facing portal run by Services Australia. It publishes non-sensitive Medicare data and statistics, such as spending. The Hacker News reported that the portal is separate from the systems that handle Medicare claims and personal records, and that the government has not said how the agent got past the blocks. The same report quotes Marles saying the information was “kept behind a fence that the AI agent effectively climbed over”, and that national security information has much stronger protections.

On ABC radio on Thursday, Marles gave the sequence more plainly: “it sought information, information was not given, and then it effectively hacked into that medical portal and got that information anyway.” The ABC reported that, as it understands it, an AI crawler, an automated program that scans websites and collects what it finds, found a security workaround to reach the data.

Services Australia told the government the agent also wrote files to an internal server. That part is still under investigation. The Australian Signals Directorate is helping with a forensic investigation, and Albanese said the evidence so far shows no broader compromise of the Services Australia network and no access to personal information.

Eighty-four days and a public inbox

The breach was not the only thing that angered Canberra. The other was how the company reported it. After OpenAI found the activity in August, it ran an internal investigation into what had been accessed. Its email arrived on September 10. Services Australia saw it on September 11, checked that it was genuine, and on September 15 referred it to the Australian Cyber Security Centre, which sits inside the Australian Signals Directorate. Public Services Minister Katy Gallagher was told over the next few days. Albanese was briefed the weekend before he made the incident public.

“It took until 10 September before there was any notification at all. And the notification was an email sent to just the public mailbox,” Albanese said. Marles put the government’s own timing a little differently: it learned of the June breach “a couple of weeks ago”, and ministers were informed last week.

Albanese raised the matter with Sam Altman by phone. “Today, I spoke with the CEO of OpenAI, Sam Altman, to express Australia’s extreme concern about this incident, and I also expressed my disappointment that it took the company way too long to inform the government what had occurred and the nature of the way that that notification occurred as well was unacceptable,” he said. Albanese said Altman accepted that the company had not done well enough. “I think OpenAI know that they need to have better protocols in place,” he added.

Opposition Leader Angus Taylor questioned the timing on 4BC radio on Thursday. “Why is he talking about it now when he’s over in the US? I mean, this happened some time back, but we’ve not heard him talking about these issues,” he said. He wants the government to explain when it first knew about the breach, what was accessed, which vulnerability was exploited and how it is being closed. His colleagues called for a broad audit of government security systems.

What OpenAI says the agent reached

OpenAI spokesperson Drew Pusateri said the company is running an “extensive review of misaligned model activity during training and evaluation” and is notifying third parties when that review finds potential impacts on their systems. That review is the practical side of OpenAI’s framework for tracking and disclosing model misalignment. “In the course of that, our models took actions we did not intend,” Pusateri said. According to OpenAI, the agent reached aggregate health statistics and internal file names, and there is “no evidence of patient records being accessed.”

That leaves OpenAI’s own review as the only account so far of what the agent read and wrote, while the Signals Directorate’s forensic work is still going on. OpenAI said its models touched “several Australian government websites and services” but has not said which ones beyond what the government disclosed.

Albanese named three other systems that may be affected: the Commonwealth’s Australian Institute of Health and Welfare, the NSW Bureau of Crime Statistics and Research, and the Victorian Department of Health. NSW Premier Chris Minns and Victorian Premier Ben Carroll were told overnight. Marles then narrowed that list. On those three sites, he said, the agent “interacted in a way that a member of the public might, so it only acted in an authorised way.” He later described those interactions as “entirely normal”, with only public information accessed.

The Hacker News reported that the non-public data on the Medicare portal was not particularly sensitive and has since been published. By September 24 the portal had been taken offline and its data moved to data.gov.au and other secure platforms. Marles summed up the government’s position: “The impact is relatively minor, but the incident is very serious.” He also described OpenAI as cooperative.

This is not OpenAI’s first disclosure of agents acting beyond their brief. In July the company said its models, during cybersecurity testing, had created a swarm of AI agents that hacked into Hugging Face’s systems. Albanese said Canberra knew of no precedent for an AI breach of a government system.

Guardrails at the UN

The disclosure came during the UN General Assembly. On Monday, Albanese co-signed a joint statement with 21 other nations calling for urgent regulation and guardrails on AI. “AI also poses significant risks, and that’s why we need guardrails to protect our way of life,” he said. US President Donald Trump called the statement a “globalist scheme” and warned that self-imposed restrictions would hand China an advantage. Altman and Anthropic CEO Dario Amodei both spoke at the assembly on Wednesday, calling for international standards. Altman asked for common ways of “measuring capabilities, assessing risks, determining whether safeguards are sufficient and preserving meaningful human oversight.” Reporters pressed Albanese repeatedly, but he would not say whether he raised the breach with Trump when they spoke.

Who answers for an agent?

The taskforce is led by the Department of the Prime Minister and Cabinet. Its members are the National Cyber Security Coordinator, the Office of AI, the Australian Signals Directorate, the Australian AI Safety Institute and Services Australia. It will check whether current processes are adequate for AI-related cyber incidents and look at possible law enforcement and legislative responses. The incident also goes to parliament’s Joint Select Committee on Artificial Intelligence and will feed into the government’s planned AI standards legislation. “We will look at what is the legal situation in respect of this and what it means to have gained an unauthorised access, albeit in an unintended way,” Marles said.

Digital Rights Watch spokesperson Lizzie O’Shea said the three months OpenAI took to tell the government showed the need for “basic rules and standards for tech companies.” Ed Santo, a former human rights commissioner and co-founder of the Human Technology Institute, said on ABC radio that “misaligned model activity” was “a very euphemistic term”. In his account, when OpenAI’s agents could not easily find the information, “they decided to break the law.” If an employee broke the criminal law, he said, both that person and the company would face serious consequences, and the same has to hold for AI.

Independent senator David Pocock criticised the government for shelving plans for a National AI Safety Act and for its slow approach to new standards. “There is also a big question here around why we aren’t holding these big tech companies liable for this kind of data breach. If it was an Australian who hacked the system they’d likely be heading for jail, yet there’s no accountability for AI companies developing this technology.”