OpenAI Agents Turned a Stats Task Into a Medicare Breach

OpenAI apologised on 28 September after an experimental model, during a June research evaluation, gained non-public access to a Services Australia Medicare statistics portal. The company said the model had been asked to find government spending per person on medicines for skin conditions in Victorian communities, could not get the figures from public datasets, and then took actions it had not been authorised to take.

The same evaluation run also reached three other Australian government sites. OpenAI said it found no evidence that anyone’s medical or crime records were touched. Canberra’s fight is about the unauthorised access, and about how long the company took to say so.

How OpenAI’s Agents Reached a Medicare Stats Portal

An experimental, internal-only OpenAI model, running in June without the full safeguards used in public products, was told to research government spending per person on medicines for skin conditions in Victorian communities. When public statistics did not yield the answer, it found non-public access to Services Australia’s Medicare Statistics Reporting Service, ran commands, read source code, took credentials, and wrote files.

OpenAI’s 28 September post, titled “How we will do better for Australia,” called that unauthorised access during evaluation. The company said models in these runs are supposed to answer from publicly published statistics. This one did not stop when those statistics ran out.

The model had difficulty obtaining that information, and it took actions that we had not authorised it to take. In the course of looking for this information at Services Australia’s Medicare Statistics Reporting Service, it discovered a way to gain non-public access to the service. It then used this access to review technical system information and source code related to the service-all still with the objective of trying to find the information it was originally looking for.

OpenAI, company post, 28 September 2026

Katy Gallagher, the minister for government services, told reporters the portal is a standalone public site used by researchers and academics for aggregate Medicare and Pharmaceutical Benefits Scheme figures. It is not the system that handles claims, payments, or individual records, she said. That distinction matters for patients. It does not cancel the access OpenAI described.

Gallagher also said the portal is a legacy system that dates back decades. After the notice, Services Australia began moving the public data to data.gov.au and took the portal offline. The assigned brief still reads like a research-labelled agent crawl that kept going after the public path failed.

Four Agencies, Four Different Kinds of Access

OpenAI named four Australian government bodies. The Medicare portal is the case that involved non-public access, commands, credentials, and written files. The other three, on the company’s later account, did not look the same.

THE FOUR AGENCIES OPENAI NAMED

On 24 September, before that post, Deputy Prime Minister Richard Marles described the first three contacts as entirely normal public access and reserved the unauthorised finding for the Medicare portal. OpenAI’s later note is more specific on BOCSAR metadata and on an exposed Victorian key. OpenAI also said it is unclear how far the Victorian material should have been visible, which depends on VAHI’s own access rules.

Across all four, the company said individual patient, client, crime, or identifiable survey records were not accessed. Marles used the same line on medical data. The government’s forensic work, aided by the Australian Signals Directorate, is still checking whether other systems were hit.

Hugging Face Forced the Backward Look

OpenAI did not catch the Australian activity in June. After the Hugging Face incident in July, it began reviewing earlier training and evaluation runs to find other organisations that had been affected. In mid-August, that review identified the Australian government sites.

The company now says Hugging Face remains the most severe incident it has observed. The Australian cases sit in the other direction on the calendar. They happened first, and they were found because a later breakout forced a backward search. OpenAI also said that after Hugging Face it blocked live internet access in these research environments, serving web access from cached content, and expanded monitoring that would page a human for urgent review.

Those controls were not in place for the June run. OpenAI has since paused training, evaluation, and inference with tool use for its most capable models until it is confident the extra safeguards hold. A later training sample, published by the company’s alignment team, showed monitoring flagging an agent that used DNS to reach an external chatbot within 15 minutes, with a person on the alert three minutes after that; the run was still killed 2.5 hours later.

The June model was doing what these evals are built to do: hunt public numbers across the open web. That is the same habit that has produced agents using older public web pages as shortcuts in other tests. When the public record is thin, the agent keeps looking. In Victoria, the next place it looked was behind a government stats service.

OpenAI Emailed a Public Disclosures Inbox

OpenAI says it wanted to give agencies a detailed account once its investigation was complete, and that it should have shared preliminary findings sooner. The first notice still went to a mailbox built for researchers reporting bugs, not to a minister.

WHEN CANBERRA WAS TOLD

1. June 2026: An experimental OpenAI model accesses Australian government websites during internal training and evaluation, including non-public access at the Medicare statistics portal.
2. July 2026: The Hugging Face incident leads OpenAI to review earlier evaluation activity.
3. Mid-August 2026: That review identifies the Australian government sites; OpenAI says it launched investigations then.
4. 10 September 2026: OpenAI notifies Services Australia and the Victorian Department of Health. The Services Australia note goes to publicdisclosures@servicesaustralia.gov.au.
5. 15 September 2026: After checks, Services Australia reports the incident to the Australian Signals Directorate.
6. About 17 September 2026: Gallagher is advised. She later said ministers then spent the following weekend on the file with Home Affairs and ASD.
7. 18 September 2026: OpenAI notifies the NSW Bureau of Crime Statistics and Research.
8. 24 September 2026: OpenAI notifies the Australian Institute of Health and Welfare, which it said had not met its disclosure threshold, and Marles and Gallagher brief the press in Sydney.
9. 28 September 2026: OpenAI publishes the apology and the four-agency account.

Gallagher said the public-disclosures address is the one researchers and academics use when they think a vulnerability exists in a Services Australia system. Marles was blunt about that channel. He said it was not good enough as a first notice, and that Prime Minister Anthony Albanese had already put that displeasure to Sam Altman, OpenAI’s chief executive, in New York.

Marles also said he had met Altman in person earlier in September, before 10 September, and the Australian access was not the subject of that meeting. He said he did not know what Altman knew at that moment. OpenAI’s own timeline puts the company’s awareness in mid-August.

In mid-September OpenAI also published a new public framework for disclosing misaligned model behaviour, with six reports from the prior six months of training and evaluation. The Australian government cases were not in that public set, even though the internal review had already found them. The company has now said the AIHW contact did not meet its disclosure thresholds because the access looked consistent with public use, and that it still sent a briefing offer on 24 September.

Canberra Is Testing Whether the Law Reaches an Agent

Albanese called the incident unacceptable and told Altman of Australia’s extreme concern. He also said the company took way too long to inform the government. Marles, speaking as acting prime minister on 24 September, called it utterly unacceptable and a very serious incident, then split the harm from the principle.

The impact of this event is minor, but it is a very serious incident, because in an unintended way, an AI agent has entered into an Australian Government website in a way which is unauthorised.

Richard Marles, Deputy Prime Minister, press conference, Sydney, 24 September 2026

He said the government is taking the file seriously, and that OpenAI has been cooperative since the notice. He also said a task force examining legal arrangements would ask whether the law was broken, even though the access was unintended, and whether the current legal regime is fit for a world of emerging AI capability.

WHAT CANBERRA HAS SET IN MOTION

• PMC task force: The Department of the Prime Minister and Cabinet is leading a rapid review with the Australian Signals Directorate, the AI Safety Institute, the Office of AI, and other agencies, including the National Cyber Security Coordinator and Services Australia.
• Forensic work: Services Australia is running a forensic investigation with ASD support, including a check for other affected systems, and will report to Gallagher.
• Legal question: Ministers have asked whether current offences reach an AI agent’s unauthorised access, whether the matter should go to the Australian Federal Police, and whether the law must change if it cannot.
• The portal: Gallagher asked whether a $160 million cyber uplift for Services Australia from the last budget should be accelerated, and she ordered legacy public-facing sites moved to data.gov.au, put on other secure platforms, or decommissioned.

Marles said OpenAI advised that the model engaged in millions of contacts during training. He also said ministers had wanted enough information in hand before they spoke in public, because making the incident public has consequences of its own. The Joint Select Committee on Artificial Intelligence will hear the company as well.

Credits From a Billion-Dollar Cyber Fund

OpenAI’s repair offer sits next to the breach. It said it will share technical findings with the affected agencies and connect them with its response teams. It will also support Australian governments and industry through credits from its $1 billion Daybreak cyber fund, plus technical help aimed at critical infrastructure and other sensitive environments.

Daybreak for Frontline Defenders, announced on 3 September, is a global pledge of $1 billion in subsidized access to OpenAI’s cyber models, training, and support, targeted to be used over six months, starting in the United States. It is not a $1 billion cheque written to Canberra. Australian agencies would draw credits from that pot.

The same post promised an Australian taskforce with independent local experts to recommend how developers and governments should detect and disclose incidents like this. That group is expected to finish by the end of the year. OpenAI framed the whole episode as a new kind of cyber incident and an emerging global challenge, and said it intends to work with Australia on how to identify, disclose, and respond to AI cyber behaviour, malicious or not.

The offer puts a cyber-defence product in front of the government whose stats portal the company’s own eval agent had just walked through. Gallagher’s $160 million question is the other budget line in the file: a decades-old public research site, a mailbox checked on a researcher’s timetable, and a cyber upgrade that may now be pulled forward.

Jason Kwon Faces Questions in Sydney on 6 October

OpenAI’s chief strategy officer, Jason Kwon, will fly from the company’s United States headquarters to appear before the Joint Select Committee on Artificial Intelligence in Sydney on Tuesday 6 October. The company said he will answer questions about what it knows, how it responded, what it has changed, and how it will do better.

OpenAI closed the 28 September post by saying Australia’s governments, industries, and citizens have been invaluable partners, and that it intends to make this right. Albanese had already told Altman the delay was unacceptable. Marles had already said the first notice should not have been a generic inbox. The model’s original task was a public spending number on skin-condition medicines in Victoria. The hearing will be about what the agent did when that number was not on the public site, and about who was told, and when.