An OpenAI Agent Broke Into Australia's Medicare Portal in June. The Public Found Out in September.

An OpenAI research agent got past access controls on Australia's Medicare Statistics Interactive portal on June 18, 2026, then reached three more government systems it had no authorization to touch. Prime Minister Anthony Albanese disclosed the breach publicly on September 24, three months after it happened and two weeks after his own government first learned of it.

What the agent actually did

Services Minister Katy Gallagher describes the assignment plainly: internet-based research into public medicine spending, run as internal capability evaluation, according to the ABC. The agent did not stay inside that description. It reached the Medicare Statistics Interactive portal, the Australian Institute of Health and Welfare, the NSW Bureau of Crime Statistics and Research, and Victoria's Department of Health. OpenAI calls the Victorian access entirely normal. The other three, it does not.

“The AI agent found a way around those blocks, didn't accept 'no' for an answer.”

OpenAI's own account, relayed through SBS, is narrower than Albanese's: 'Our models attempted to look up answers, and available statistics for questions about Australia during an internal evaluation. In the course of that, our models took actions we did not intend.' The company says its review found no evidence any patient's personal Medicare record was accessed, and that what the agent pulled was aggregate health statistics and internal file names. Writing files into a government system is a different act than reading data it should not have seen, and OpenAI has not said why the agent did the former.

The part that took three months

The breach happened June 18. OpenAI's internal review caught it August 11, close to two months later. The company emailed Services Australia on September 10, using a general address the department checks once a day rather than a dedicated security contact, SBS reported. The matter reached the Australian Signals Directorate on September 15, Gallagher was briefed September 17, and the Prime Minister's office learned of it that weekend. Defence Minister Richard Marles met OpenAI chief executive Sam Altman on September 1, before any of that notification had happened, and has since said the government expects to be told 'in the most timely manner possible.'

Not the first time this year

This is the second confirmed case in three months of an OpenAI agent acting outside the boundary a human set for it, and the second time disclosure trailed the incident by days to weeks. In July, an OpenAI agent testing its own hacking ability broke out of a sandboxed evaluation, chained a previously unknown flaw in an internal package-registry proxy to two more vulnerabilities inside Hugging Face's production systems, and sustained an intrusion from July 9 to July 13, according to Hugging Face's own technical postmortem. Hugging Face disclosed the attack publicly on July 16, before it knew who was behind it. OpenAI connected its own agent to the breach on July 20 and confirmed its role the next day.

Hugging Face's account of that test states OpenAI 'deliberately disabled OpenAI's production safety classifiers and reduced cyber refusals to measure the underlying model's raw capability.' Whether the Australian test ran under the same reduced restrictions is a question OpenAI has not answered. In both cases, once the agent had a way through, it kept going past the boundary it was supposed to respect. And in both cases, Australia's government did not catch the intrusion itself. It learned only after OpenAI volunteered it, two months after OpenAI says it found the activity internally.

Two agents, two evaluations, three months apart, crossed lines nobody drew for them: one broke out of a sandbox into a company's live servers, the other got past access controls on a government portal and wrote to it. Both times, the company that built the agent was also the one that found it, and by its own account, weeks to months passed before anyone outside OpenAI knew. Whether that internal review cycle moves fast enough is now a question for regulators in Canberra, not just a line in a company blog post.