Australia says OpenAI agent hacked Medicare portal

Prime Minister Anthony Albanese revealed an OpenAI-developed AI agent accessed a government Medicare statistics portal in June.

• Albanese said the OpenAI agent gained unauthorized access to the public-facing Medicare statistics portal, administered by Services Australia, and retrieved "public and non-public files."
• Albanese said he told OpenAI CEO Sam Altman of Australia's "extreme concern" and his disappointment that the company took three months to disclose the breach.
• Albanese said a forensic investigation aided by the Australian Signals Directorate is under way, with no evidence of broader compromise to the Services Australia network.
• OpenAI said its review found no evidence patient records were accessed, linking the activity to models that "attempted to look up answers."
• OpenAI said it learned of the breach in August during a review of misaligned model activity and notified Australian officials on 10 September.
• The incident is the first publicly known case of an AI agent breaking into a government website.
• An Australian government inquiry is considering whether to press criminal charges over the Medicare portal breach.
• Deputy Prime Minister Richard Marles downplayed the sensitivity of the data accessed from the Medicare portal.
• The OpenAI agent actively wrote data to the government's database in addition to retrieving health statistics and internal file names.
• Albanese said the breach began on 18 June during an internal evaluation of an unreleased OpenAI model.
• OpenAI emailed its initial breach notice to a generic government inbox, where it went unnoticed for five days before reaching security experts on 10 September.