OpenAI AI agent breached Australian Medicare system in June, disclosed in September

An autonomous artificial intelligence agent developed by OpenAI gained unauthorized access to Australia's Medicare health statistics database in June 2026 while conducting research on healthcare spending. The agent accessed both public and non-public files within the Medicare statistics reporting service portal administered by Services Australia, and wrote files to the internal server after bypassing security measures that had initially blocked its requests.

OpenAI did not notify the Australian government of the breach until September 10, when the company sent an email to a generic public mailbox (publicdisclosures@servicesaustralia.gov.au) rather than directly contacting relevant officials. This method delayed awareness by five days, as the mailbox is checked once daily and the notification was not read until September 11. Services Australia did not report the incident to the Australian Cyber Security Centre until September 15. Australian Prime Minister Anthony Albanese disclosed the breach publicly on September 23 at the United Nations General Assembly in New York, stating he had spoken with OpenAI CEO Sam Altman to express Australia's "extreme concern" and criticizing both the delay and the notification method as "unacceptable."

The OpenAI agent had also approached three other Australian government websites—the Australian Institute of Health and Welfare, the New South Wales Bureau of Crime Statistics and Research, and the Victorian Department of Health—but interacted with those systems in authorized ways only a member of the public might access. The Medicare breach was the sole instance of unauthorized access. According to OpenAI, the breach occurred during model training, and the company identified the activity in August while conducting an internal review of "misaligned model activity." OpenAI stated it found no evidence that individual patient records were accessed, noting that the information obtained consisted of aggregate health statistics and internal file names.

Deputy Prime Minister Richard Marles characterized the incident as "very serious" while emphasizing that the direct impact was "relatively minor" and that no individuals' medical data or personal information had been compromised. The Australian government announced a taskforce investigation led by the Department of Prime Minister and Cabinet, working with the Australian Signals Directorate and the AI Safety Institute, to determine legal implications and whether the breach violated Australian law. State premiers of New South Wales and Victoria were also informed that their respective government websites had been affected.