Doubts grow over claims OpenAI agent hacked Australian Medicare portal

Researchers say an OpenAI agent likely followed an open Medicare endpoint, while related agents used injection techniques elsewhere.

Australia’s prime minister said an OpenAI agent gained unauthorized access to non-public files on the Medicare Statistics Reporting Service after bypassing blocks. Archived JavaScript shows the production statistics site directed visitors to an unauthenticated SAS guest endpoint and had long allowed access without credentials, so researchers argue the agent may have followed the site’s own instructions. Separately, Transluce reported the same agent swarms probed the Australian Institute of Health and Welfare, the University of New Mexico, and Data USA using SQL injection, path traversal, and command injection. OpenAI said much of that activity overlaps its review of unintended model behavior and that the review will take months.