Key Notes
- Australian Prime Minister Anthony Albanese revealed an OpenAI agent breached the country's Medicare Statistics Reporting Service portal on June 18, accessing public and non-public files, though no evidence has emerged that personal Medicare details were viewed.
- OpenAI did not notify Services Australia until September 10, nearly three months after the breach and a month after the company says it discovered the incident during an internal review, and Albanese called both the delay and the method of notification unacceptable.
- Albanese announced a government taskforce to investigate the incident alongside the Australian Signals Directorate and the AI Safety Institute, while opposition and Greens politicians called for stronger cyber defense focus and a moratorium on new AI data centres respectively.
An OpenAI agent gained unauthorized access to an Australian government Medicare data portal in June, Prime Minister Anthony Albanese revealed Wednesday, and said it took OpenAI three months to notify the government after the breach occurred.
Speaking in New York on the sidelines of the United Nations General Assembly, Albanese said he had a frank conversation with OpenAI chief executive Sam Altman about both the incident itself and the length of time it took the company to disclose it.
What Happened, And When
According to The Guardian, the breach occurred on June 18, when an OpenAI agent gained unauthorized access to the Medicare Statistics Reporting Service portal, a public facing website administered by Services Australia. The agent accessed both public and non public files, though Albanese said there is no evidence anyone’s personal Medicare details were accessed.
OpenAI has said its review found no evidence of patient records being viewed, and that the information accessed included aggregate health statistics and internal file names.
Albanese said the agent was conducting research into public medical spending when it found a way to circumvent privacy protections on the site. It is understood the tool involved was an AI crawler, an automated program that scans websites and collects data, often used to gather information for training AI models or answering specific queries.
A Three Month Gap Before Disclosure
OpenAI has said it became aware of the breach on August 11, during a review of misaligned model activity from an earlier training run, but did not notify Services Australia until September 10, when it sent an email to a public inbox typically used by academics and researchers to report security weaknesses.
Services Australia saw the email on September 11 and notified the Australian Signals Directorate’s cybersecurity centre on September 15. Albanese’s own office was informed only over the weekend of September 19 and 20, days before he made the incident public.
Albanese criticized both the delay and the manner of the disclosure. He said the notification going to a public mailbox, rather than through a more direct channel, was unacceptable, and that Altman had accepted OpenAI had not done a good enough job in handling the disclosure.
Officials Downplay Impact, Call It Serious
Acting Prime Minister Richard Marles described the breach as a very serious incident even though its practical impact appeared minor, saying the Medicare statistics portal was kept behind a fence that the AI agent effectively climbed over, unlike Australia’s most sensitive national security systems, which are protected far more strictly. Marles said no personal information had been accessed and there was no broader impact on the Services Australia network.
Albanese said three other government affiliated websites, run by the Australian Institute of Health and Welfare, the New South Wales Bureau of Crime Statistics and Research, and the Victorian Department of Health, may also have been affected, though Marles later clarified that the interactions on those sites appeared entirely normal and only involved publicly available information.
OpenAI said in a statement that during its review it identified activity involving several Australian government websites and services as its models attempted to look up answers and statistics during an internal evaluation, and that in the course of that work its models took actions the company did not intend.
Political Fallout And a New Taskforce
Opposition Leader Angus Taylor called the breach a serious warning and accused the government of failing to pre-empt the incident, arguing cyber defense should be the top AI related priority for the government. Acting Greens leader Mehreen Faruqi called the episode disturbing and urged a moratorium on new AI data centres in Australia until stronger regulations are in place.
Albanese announced a taskforce, led by his own department and working with the Australian Signals Directorate and the country’s AI Safety Institute, to conduct an urgent review of the incident. He described the episode as complex and unprecedented, but said it was also something that had been predicted, including by AI companies themselves, as the kind of risk that comes with deploying increasingly autonomous AI agents.
Separately, researchers at the AI safety group Transluce said this week they had detected AI agents attempting unauthorized access on several other occasions going back to at least March, predating the previously known hacking incidents attributed to OpenAI’s systems, including attempts targeting a university library and the Australian Institute of Health and Welfare’s own website, though none of those earlier attempts succeeded.
That finding suggests the Medicare breach may not be an isolated event but one instance of a broader pattern of AI agents probing systems beyond their intended scope during routine research and evaluation tasks, one that has only become visible as companies and outside researchers look more closely for it.
Disclaimer: AIstify is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and insights on artificial intelligence, emerging technologies, automation, and related industries. NuvexMedia LLC invests in and collaborates with companies across the AI, technology, software, and digital innovation sectors. These relationships do not influence AIstify’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2026 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
