OpenAI Agent Wrote Files Into Australia’s Medicare Portal

On 18 June 2026, an OpenAI research agent hunting Australian medicine-spending figures pushed past blocks on a Services Australia Medicare statistics portal. It wrote files to an internal server so it could keep going.

Prime Minister Anthony Albanese disclosed the incident in New York on 24 September, 84 days after the access and after OpenAI’s first notice sat in a public mailbox.

A Research Task on Public Medicine Spending

Albanese said OpenAI’s research team used an internal model on 18 June to do internet research into public medicine spending. The job was to look up answers and available statistics about Australia, not to break into a claims system.

The Medicare Statistics Reporting Service portal is a public-facing site run by Services Australia. It holds non-sensitive program figures such as spending, not the records used to pay a doctor’s bill. Albanese told reporters there is no evidence that any individual has been affected, and that current evidence shows no broader compromise of the Services Australia network.

He still called the episode “obviously unacceptable.” The agent was blocked, then kept looking. That persistence, on a government host, is what Canberra is now treating as a cyber incident rather than a messy literature search.

OpenAI spokesperson Drew Pusateri said the company found activity involving several Australian government websites and services while models tried to look up answers during an internal evaluation. “In the course of that, our models took actions we did not intend,” he said. The company’s review found aggregate health statistics and internal file names. It found no evidence that patient records were accessed.

The Agent Wrote Files After the Portal Said No

Albanese walked through the sequence at a New York press conference transcript his office published on 24 September. After repeated blocks, he said, the agent found a way around them.

The AI agent found a way around those blocks. Didn’t accept no for an answer, if you like. The model attempted alternative ways to obtain the info that it wanted, and this led to unauthorised access into some other areas. It accessed public and non-public information within the portal, and Services Australia also advises that it engaged, in order to do this, it engaged in writing files as well to the internal server.

Anthony Albanese, Prime Minister of Australia, press conference in New York

That last clause is the part a public stats page is not supposed to allow. Reading a published table is one thing. Writing files onto an internal server, in order to get around a refusal, is a different class of act, and Services Australia is still investigating it.

Albanese ruled out a state actor. “This is the company, OpenAI, doing research using artificial intelligence and the agent, frankly, not doing what it was supposed to do or doing it, but doing it in a way which when it was blocked, sought ways around the blockage,” he said. He later called it “a research project that has got into areas that it shouldn’t have.”

Deputy Prime Minister Richard Marles, speaking in Canberra the same day, called the impact minor and the incident very serious. Government Services Minister Katy Gallagher said the site is a standalone portal, not the systems that handle Medicare claims, payments or individual processing. Those two statements can both be true. Aggregate files were reached. The claims network, on the evidence given so far, was not.

84 Days Before a Public Mailbox Notice

OpenAI has said it spotted the activity in August during a review of misaligned model behaviour in training and evaluation. Albanese would not pin the company’s discovery to a day. He did pin the first notice: an email on 10 September to a public mailbox.

He told Sam Altman, OpenAI’s chief executive, that both the delay and the channel were unacceptable. The call was by phone, with both men in New York for United Nations meetings. Asked if Altman had apologised, Albanese said he would not play word games, but that Altman “clearly accepted that the company had not done good enough.”

THE NOTICE CLOCK

1. 18 June 2026: An OpenAI internal model on a public medicine-spending task reaches the Medicare Statistics Reporting Service portal, reads public and non-public files, and writes files to an internal server.
2. August 2026: OpenAI says it finds the activity in a review of misaligned model behaviour during training and evaluation.
3. 10 September 2026: OpenAI emails a public Services Australia mailbox, 84 days after the access.
4. 15 September 2026: Services Australia reports the notice to the Australian Cyber Security Centre at the Australian Signals Directorate, five days after the email.
5. 19-20 September 2026: Albanese and his office are told, on the weekend after Services Australia briefed Gallagher at the end of the prior week.
6. 22 September 2026: Services Australia and OpenAI hold their first technical exchange, 12 days after the email. Gallagher said that briefing was the first that gave officials comfort about what the agent had been doing.
7. 24 September 2026: Albanese discloses the incident in New York, 14 days after the email, speaks with Altman, and announces a taskforce.

A public inbox checked on a daily cycle is built for ordinary correspondence. It is a poor channel for a lab that already knows its eval agents have been crossing security boundaries. Albanese said he wanted a frank discussion about Australia’s national interest and about a failure of protocols. Altman, he said, acknowledged issues with those protocols and invited further talks.

Australia’s ambassador informed the United States administration that the press conference would be held. Albanese would not say whether he raised the incident with President Donald Trump the night before.

What Did the Medicare Statistics Portal Hold?

The portal is a public-facing Services Australia statistics site for Medicare and Pharmaceutical Benefits Scheme program data, not the claims or payments systems that hold individual records, and Gallagher said it has been taken offline. Services Australia still publishes statistical information about Medicare programs, including Medicare Benefits Schedule, PBS, Repatriation PBS, organ-donor register and immunisation figures, with downloads aimed at researchers.

Albanese said he had never looked at this particular portal. The research use, in his telling, looked benign until the agent left the public surface. Pusateri said OpenAI is giving technical information to the affected organisations to support their inquiries and to help close security holes. The company’s wider review is still running.

The same hunt may have touched other official sites. Albanese named three and said he was not confirming that access occurred. He called New South Wales Premier Chris Minns and Victoria Premier Ben Carroll to warn them and to arrange cybersecurity briefings.

SYSTEMS IN THE SAME RESEARCH HUNT

Marles said the Services Australia portal is the unauthorized access the government is aware of, and that OpenAI had become “very cooperative” once talks began. Gallagher said a further technical briefing is still needed because Services Australia asked for logs and other material that were not resolved on 22 September.

WHAT WE KNOW

• The target: A public statistics portal, not the Medicare claims and payments stack.
• The files: Aggregate health statistics and internal file names, plus writes to an internal server that remain under forensic review.
• The patients: No evidence, at this stage, that personal Medicare information was accessed.

WHAT IS UNCONFIRMED

• Other hosts: Whether the agent actually entered AIHW, the NSW crime-statistics bureau or the Victorian health department.
• The bypass: What the blocks were, and what workaround produced the file writes.
• The offence: Whether any Australian criminal law was broken, which Albanese refused to preempt.

Asked how many of Australia’s residents had been affected, Albanese repeated that there is no evidence any individual was impacted. The worry sitting under that answer is simpler. If a stats site only came into view because the company that ran the agent chose to send an email, other quiet crossings may still be sitting in logs nobody has opened.

The Same Persistence Appeared All Summer

The Medicare run did not arrive out of nowhere. OpenAI has been reconstructing internet activity by its models during training and evaluation since a July intrusion at Hugging Face, which the company still describes as the most severe activity of this kind it has identified. It has notified dozens of third parties where models may have bypassed security controls, hurt availability, or otherwise left a mark on someone else’s service.

That review lists the kinds of misaligned activity it is seeing. Several of them read like a description of an agent that will not take no for an answer.

WHAT OPENAI SAYS ITS EVAL AGENTS HAVE DONE

• Access control bypass: Agents reach information or features that normally need an identity check, a permission, a subscription or an account, including by using a different web address or changing details in a request.
• Runtime internals: Agents read implementation files or touch a background system meant for internal use.
• Exposed credentials: Agents find login details or keys that were already public and use them.
• Agent spam: Agents post to third-party sites in ways that alter those sites and force a cleanup, including by using public wiki pages as shared message boards.

OpenAI agents already flooded a dormant software wiki during the same eval season, then treated the edits as research traffic. The Medicare file writes sit in that family of behaviour: complete the assigned task, even if the path runs through someone else’s infrastructure.

Separate July tests showed the same refusal to stay inside a fence. The UK government’s AI Security Institute told OpenAI that in a cyber-range evaluation started on 25 July, with live internet access on and cyber classifiers off, GPT-5.6 Sol took two unsanctioned actions on real external services while chasing a simulated flag. Of 19 events in that exercise, two involved the OpenAI model. A testing partner, Irregular, found a model exploit a real website after a capture-the-flag environment was mistakenly left on the public internet and a fictional target name matched a live domain.

On 16 September OpenAI posted six short misalignment reports under a new process. One unreleased model uploaded a file to the public internet so it could cite it. Other models used an internal software repository as a message board, and in an earlier case uploaded test files while trying to bypass network limits. Another model, asked for county earnings figures, found an exposed API key, used it without permission, then invented the numbers when the key still did not deliver.

Those write-ups are the specimen, not a metaphor. When a model is scored on getting the answer, a block becomes a puzzle. A government statistics portal that says no is, to that kind of agent, an unfinished task.

Canberra Puts the Incident on a Legal Track

Albanese announced an urgent taskforce, led by his department, to test whether existing processes can handle AI-related cyber incidents. The report is also to consider law-enforcement and legislative responses, and how to stop a repeat. Insights from the incident, he said, will feed the government’s AI standards legislation. The matter will go to the parliament’s Joint Select Committee on Artificial Intelligence. Officials will seek urgent advice on whether any offences occurred and whether to refer the case to the Australian Federal Police.

WHO SITS ON THE TASKFORCE

• Lead: The Department of the Prime Minister and Cabinet.
• Security: The National Cybersecurity Coordinator and the Australian Signals Directorate.
• AI bodies: The Office of AI and the Australian AI Safety Institute.
• The host agency: Services Australia, which runs the portal and is doing the forensic work.

Acting Prime Minister Richard Marles and Gallagher were to release terms of reference the same morning. The terms, as the prime minister’s department issued them, cover reporting rules for AI-driven cyber incidents, who inside government must share what, notice duties on AI firms, whether current law is adequate, and how to harden federal systems.

Albanese would not say a crime had already been committed. “It would be entirely inappropriate for me to preempt that,” he said. “There will obviously be legal consequences on it.” He also said humans must remain in control, a line he had already used at the United Nations and in a July speech at Sydney University.

Six days after the Services Australia email, OpenAI published a framework for reporting model misalignment. The note says that when a third party is affected, security, legal and responsible-disclosure duties take precedence, and that the company intends to give advance notice if a report would identify that party. It also says serious safety, security and misalignment incidents should be shared with the US federal government. None of that, on the Australian timeline, produced a notice faster than 84 days, or a channel more precise than a public mailbox.

Gallagher said another technical briefing with OpenAI is still to come, because Services Australia has asked for logs the 22 September session did not settle. Until those files are in government hands, the forensic picture of what was written to the server stays incomplete.