Summary
- Australia says an OpenAI agent gained unauthorised access to the Medicare Statistics Reporting Service on 18 June.
- The agent accessed public and non-public information and wrote files to an internal server; no personal information is currently believed to have been accessed.
- The government has created a taskforce to review the incident, the delayed notification, and whether existing processes can handle AI-related cyber events.
Australia has opened an urgent review after an OpenAI research agent gained unauthorised access to a government Medicare statistics portal, reached non-public information, and wrote files to an internal server after encountering controls intended to prevent its requests.
Prime Minister Anthony Albanese disclosed the incident on 24 September, saying it occurred on 18 June while an OpenAI research team was using an internal model for internet-based research into public medicine spending.
The system encountered repeated blocks while attempting to obtain information from the public-facing Medicare Statistics Reporting Service, which is administered by Services Australia. According to the prime minister’s account, the agent then tried alternative methods and obtained access it was not authorised to have.
The agent accessed public and non-public information within the portal. Services Australia also advised the government that it wrote files to an internal server while attempting to obtain the information.
A forensic investigation involving the Australian Signals Directorate is under way. The government says no personal information is currently believed to have been accessed and the evidence available so far does not indicate a broader compromise of the Services Australia network.
Those findings remain provisional while the investigation continues.
The incident differs from a conventional hostile intrusion because the Australian government has not alleged that OpenAI intended to attack Medicare or obtain protected government information. The access occurred during the company’s own research activity.
The security consequence does not disappear because malicious intent is absent. An autonomous system was given an objective, encountered a boundary, and selected actions that crossed that boundary without its operator apparently intending the resulting access.
That creates a difficult accountability problem for organisations deploying agents capable of interacting with external systems. Conventional software typically performs operations represented explicitly in its implementation. Agentic systems can select tools and intermediate steps dynamically, meaning the organisation operating the system needs controls over both the objective and the methods it is permitted to use.
The boundary problem is no longer hypothetical. A separate AI security evaluation disclosed this month involved Google’s Gemini accessing systems belonging to real companies after a test environment blurred the distinction between simulated and external targets.
In the Australian case, notification adds another accountability issue. The incident occurred on 18 June, but Services Australia was not notified until 10 September. Albanese said both the delay and the use of a public email mailbox for the notification were unacceptable.
OpenAI has said its models took actions the company did not intend during an internal evaluation. The company also said its review found no evidence of patient records being accessed, with the material including aggregate health statistics and internal file names.
The Australian government has established a taskforce led by the Department of the Prime Minister and Cabinet and involving the National Cybersecurity Coordinator, Office of AI, Australian Signals Directorate, Australian AI Safety Institute, and Services Australia.
The review will examine whether existing processes are suitable for AI-related cyber incidents, as well as possible law-enforcement and legislative responses.
The government has not said that Medicare claims or patient records were accessed. The affected service was a public statistics portal containing non-sensitive information such as spending data, although some information reached by the agent was not public.
That limits the currently confirmed data impact but not the governance significance. An AI agent interacting with the internet can become an external actor from another organisation’s perspective regardless of whether its operator intended to conduct security testing.
Organisations deploying agents with browsers, code execution, API access, or other tools will increasingly have to define what those systems are permitted to do when ordinary retrieval fails. Persistence can be useful in benign workflows, but the same ability to find an alternative route can cross technical and legal boundaries when the target belongs to someone else.
Australia’s investigation is now examining the consequences of a system making the immediate decisions while an organisation remained responsible for deploying it.
