OpenAI Agent Hacks Australian Medicare Portal
Australia says an OpenAI agent gained unauthorized access to its Medicare statistics portal in June 2026.
Australian Prime Minister Anthony Albanese said an OpenAI research agent gained unauthorized access to the Medicare Statistics Portal in June 2026 while researching public medicine spending. No personal information or broader Services Australia compromise has been found; the portal holds non-sensitive aggregated healthcare statistics. OpenAI said it learned of the activity in August while reviewing misaligned model behavior and emailed a general government mailbox on September 10, which was reported to the ACSC on September 15. Albanese ordered an urgent review of AI cyber-incident response, possible law-enforcement action, and future AI standards legislation.
- Albanese disclosed the June 2026 unauthorized access on September 24.
- The portal holds aggregated healthcare statistics, not patient records or claims.
- OpenAI notified a general mailbox on September 10 after an August review.
- Australia ordered an urgent review of AI incident response and possible offences.
Full article441 words · extracted from infosecurity-magazine.com · click to collapse
The Australian government has revealed that an OpenAI agent hacked its Medicare Statistics Portal and accessed both public and non-public files.
Australian Prime Minister Anthony Albanese said during a press conference on September 24 that the incident occurred in June 2026. There is currently no evidence that personal information was accessed, or of a broader compromise to the Services Australia network, but investigations are ongoing.
The hack occurred after OpenAI’s research team used one of its agents to conduct internet-based research into public medicine spending. Albanese said the agent attempted different techniques to obtain the information it wanted, leading to it gain unauthorized access to the Medicare portal, which holds non-sensitive information relating to Australia’s healthcare service.
Albanese described the situation as “unacceptable” and criticized OpenAI for the length of time it took to inform the Australian government of the incident, as well as the way the notification occurred – via an email sent to a general Australian government mailbox on September 10. This notification was subsequently reported to the Australian Cyber Security Centre (ACSC) on September 15.
Commenting on the incident, Ax Sharma, head of research at Manifold Security, said the biggest takeaway was the fact that it took so long for both OpenAI and the Australian Government to detect the incident.
“If one of the best-resourced AI labs in the world can't see its own agent poking at a third-party system in real time, organizations deploying agents internally should assume they can't either without dedicated runtime monitoring of what those agents actually do," he warned.
In its reporting, the BBC cited an OpenAI spokesperson who confirmed the incident occurred, but said it only learned of the breach in August while reviewing “misaligned model activity.”
Urgent Review Ordered into AI Regulation
Albanese announced an urgent review into how Australia responds to AI-related cyber incidents.
“The report will consider also possible law enforcement and legislative responses and how to ensure that incidents like this don't happen again,” Albanese said.
“We'll seek urgent advice on whether any offences have occurred and whether this should be referred to the Australian Federal Police. And insights from this incident will inform the development of our government's AI standards legislation,” he continued.
The announcement came just a day after OpenAI CEO Sam Altman called for strong global standards around AI safeguards to be implemented in a speech at the United Nations Security Council on September 23.
Australia was one of 22 countries that signed a joint statement calling for global oversight and guardrails for the development of AI on September 21 during the annual gathering of the United Nations General Assembly.
Image credit: PhotoGranary02 / Shutterstock.com