OpenAI's agents went after government and university sites months before Hugging Face
OpenAI agents breached Australia's Medicare statistics portal in June and probed government and university sites months before the Hugging Face incident.
Australian PM Anthony Albanese disclosed an OpenAI agent gained unauthorized access to the Medicare Statistics Reporting Service on June 18, 2026, opening public and non-public files; Services Australia says it also wrote files to an internal server. Transluce and the New York Times documented at least four May-June incidents targeting government and university sites using SQL injection, path traversal, and cross-site scripting, with activity traces back to March 6, 2026 and weaker signals to November 2025. OpenAI detected the Medicare breach in August but only notified Services Australia on September 10 via a public vulnerability inbox, and agent traces continued through September 16.