OpenAI Agent Bypassed an Australian Government Health Portal During Internal Research

OpenAI’s AI agent bypassed controls on an Australian health portal, accessed non-public files and triggered a government investigation.

An OpenAI AI agent bypassed access controls on an Australian government health statistics portal in June, accessing both public and non-public files in what Australian authorities are treating as a serious AI-related cyber incident. The case was disclosed by Prime Minister Anthony Albanese on September 24 and is now the subject of a forensic investigation involving the Australian Signals Directorate.

“I want to update Australians on an incident in which an artificial intelligence agent has infiltrated an Australian Government website. This incident occurred in June of this year and involved an OpenAI agent gaining unauthorised access into the public-facing Medicare statistics reporting service portal, which is administered by Services Australia.” said Albanese in the press conference. “The AI agent accessed both public and non-public files.”

The incident involved the Medicare Statistics Reporting Service portal operated by Services Australia. Despite the name, the portal does not handle individual Medicare claims or patient records. It publishes aggregated information, including statistics on healthcare and medicine spending. Albanese confirmed that no personal data or wider Services Australia compromise has been found so far.

The agent did, however, reach files that were not publicly available, and Services Australia said it also wrote files to an internal server. That part of the incident remains under investigation.

The sequence is what makes the case interesting from a security perspective.

On June 18, an OpenAI research team was using an internal model to collect information about public medicine spending. The agent encountered repeated restrictions while trying to obtain information from the Australian portal. Instead of stopping, it tried alternative approaches and eventually reached areas it was not supposed to access.

Albanese described the behavior during a press conference in New York.

“There were blocks clearly which were coming back telling the AI agent, no. The AI agent found a way around those blocks. Didn’t accept no for an answer, if you like. The model attempted alternative ways to obtain the info that it wanted, and this led to unauthorised access into some other areas.” Prime Minister added. “It accessed public and non-public information within the portal, and Services Australia also advises that it engaged, in order to do this, it engaged in writing files as well to the internal server.”

That sentence captures the problem better than the word “hack” does. This was not a conventional attacker manually exploiting a known vulnerability. An AI agent was given a research objective, encountered a technical restriction and continued looking for another way to complete the task.

The Australian government has not disclosed technical details of the hack. The incident therefore should not be treated as evidence of a particular vulnerability in the portal. What is known is that the agent moved beyond the intended access boundary and reached non-public material.

There is also a disclosure problem.

OpenAI told Services Australia about the incident on September 10, almost three months after the activity occurred. The notification was sent to a general public mailbox. Services Australia subsequently verified the message and reported the incident to the Australian Cyber Security Centre on September 15.

Albanese was openly critical of the delay.

“It was both. It was the delay, firstly. It was that it took until 10 September before there was any notification at all. And the notification was an email sent to just the public mailbox.” Albanese said. “And I had that discussion very frankly with Mr Altman. He accepted that that was”

The Australian government has now created a taskforce to review how the country handles cyber incidents involving AI systems. The group will include the National Cybersecurity Coordinator, the Office of AI, the Australian Signals Directorate, the Australian AI Safety Institute and Services Australia. The government will also examine possible law-enforcement and legislative responses.

The investigation is also looking at three other Australian government websites that the same research activity interacted with. Those include the Australian Institute of Health and Welfare, the Victorian Department of Health and the NSW Bureau of Crime Statistics and Research. Authorities currently describe the activity involving those sites as normal access to public information, rather than the unauthorized access reported on the Medicare statistics portal.

“The question is when it was trying to harvest data, did it go into these other sites? So, we’re not confirming that that occurred. These sites are all, it’s all looking for data on medicines, data on health. Now, why that was the case? I assume commercial reasons of why it’s looking at how much has been spent on particular medicines. Is it increasing spending? Is it decreasing spending? Those issues as well.” concludes the politician.

The incident comes as researchers and governments are increasingly testing what happens when AI systems are given access to the real internet. Other recent evaluations have shown models attempting actions they were not explicitly authorized to perform, including probing websites, using exposed credentials and interacting with live systems.

Traditional software usually does what developers explicitly program it to do. An AI agent can interpret a goal and choose its own sequence of actions to reach it. If the system can browse websites, execute code, use tools or access external services, a simple instruction such as “find this information” can turn into a much more complex chain of decisions.

The Australian incident shows why access controls cannot rely only on the assumption that an AI system will stop when it receives a denial. A system that can reason about alternative routes may treat a blocked request as a problem to solve rather than a boundary to respect.

There is an important distinction, however. The available evidence does not show that the agent deliberately set out to compromise an Australian government system, nor does it establish that personal medical data was accessed. The Australian investigation is still underway, and the government says the impact identified so far is limited to an aggregated statistics environment.

For security teams, the lesson is less about OpenAI specifically and more about how AI agents should be treated when they operate outside the sandbox.

If an agent can reach the internet, it should be assumed that it may encounter systems that reject its requests. Those boundaries need to be enforced outside the model itself, with network controls, authentication, monitoring, and permissions that do not depend on the agent deciding to behave correctly.

The Australian government is now reviewing exactly that problem. And as AI agents become more capable, the question will increasingly move from what a model can generate to what it is allowed to touch.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, artificial intelligence)

---

---