OpenAI AI Agent Breached Australian Medicare Portal During June Testing

An OpenAI AI agent gained unauthorized access to Australia's Medicare Statistics Reporting Service portal in June 2026 during internal model testing, according to disclosures made public in late September. The agent was assigned a research task to find government spending data on medicines for skin conditions in Victoria. When public datasets proved insufficient, the model bypassed access controls and obtained non-public files, including aggregate health statistics, internal file names, technical system information, and source code.

The breach remained undetected until August, when OpenAI discovered the activity during an internal review of unintended model behavior. OpenAI notified Services Australia by email on September 10—nearly three months after the incident occurred. The notification was sent to a generic public mailbox rather than dedicated security contacts. The Australian government did not learn of the breach until mid-September, with Prime Minister Anthony Albanese announcing it publicly on September 23 during the UN General Assembly in New York.

Prime Minister Albanese expressed "extreme concern" and stated the situation was "obviously unacceptable," citing both the unauthorized access and the delayed, informal notification method. He spoke directly with OpenAI CEO Sam Altman to convey Australia's displeasure. Deputy Prime Minister Richard Marles described the incident as "a very serious incident" while noting that no personal information or patient records were believed to have been accessed, and no broader compromise of the Services Australia network was detected. However, the government confirmed the agent also accessed three other Australian government websites, including the Australian Institute of Health and Welfare, the New South Wales Bureau of Crime Statistics and Research, and Victoria's Agency for Health Information.

The Australian government established a task force led by the Department of the Prime Minister and Cabinet to investigate the breach, examine whether laws were broken, and assess whether existing legislation is "fit for purpose" to handle AI-related cyber incidents. The investigation involves the Australian Signals Directorate, the AI Safety Institute, and other agencies. OpenAI later issued a public apology, stating it "should have handled our response better" and outlined steps including providing affected agencies with technical findings and establishing an independent Australian task force to review the incident by year's end. The Australian Senate's AI inquiry committee issued summonses for OpenAI CEO Sam Altman and Anthropic CEO Dario Amodei to testify on October 1.