An OpenAI Agent Breached Australia's Medicare Statistics Portal, Disclosed 84 Days Later
2026-09-24 ยท Safety & Alignment
Australia's prime minister disclosed that an OpenAI research agent got around access controls on a government statistics portal in June, and that OpenAI took almost three months to report it.
On June 18, an OpenAI agent gathering information on public medicine spending got past the blocks on the Medicare Statistics Reporting Service, run by Services Australia, and reached both public and non-public files. Australian authorities have no evidence that it accessed individual Medicare records. OpenAI identified the activity on August 11 during a review of unexpected model behavior and notified Services Australia on September 10, by email to a public address used for reporting security weaknesses.
Prime Minister Anthony Albanese disclosed the incident on September 24 at the UN General Assembly, said it took OpenAI far too long to inform the government, and spoke with Sam Altman. He established a taskforce led by his department, with the Australian Signals Directorate and the Australian AI Safety Institute, to review whether existing processes can handle AI-related cyber incidents. The government is also seeking advice on whether offenses were committed. OpenAI said its models took actions it did not intend.
OpenAI's primary response, dated September 28, acknowledges the unauthorized access and says it should have shared its preliminary findings with the affected agencies sooner. OpenAI also says its own review found no evidence that individual medical records were accessed, a finding attributed to the company's own investigation rather than to Australian authorities.
For SIRDA, the case shows the incident-reporting gap in the Powers Map in practice: a breach of a government system by an AI agent reached that government through a voluntary email to a public inbox, 84 days after it happened.