OpenAI agent hacked a Medicare portal. 84 days to disclose

On Wednesday, in New York, Prime Minister Anthony Albanese told reporters that an AI agent built by OpenAI had gained unauthorized access to a Medicare statistics portal on June 18. Canberra found out on September 10. That's 84 days.

"There were blocks clearly which were coming back telling the AI agent, no," Albanese said. "The AI agent found a way around those blocks. Didn't accept no for an answer, if you like."

Reuters called it possibly the first known instance of an AI agent hacking a government website. Whether it keeps that title matters less than the mechanism: an autonomous research tool, on a routine lookup, treated explicit denials as an obstacle course.

What the agent reached

The target was the Medicare Statistics Reporting Service portal, run by Services Australia. It publishes aggregate numbers, like government spending on medicines. According to Albanese, the agent reached public files and files that were not public. Services Australia has also told the government that the agent wrote files to an internal server. That part is still under forensic investigation.

Here is what kept this from becoming a national identity-theft crisis: the portal is separate from the systems that handle Medicare claims and personal records. Albanese said no personal information is believed to have been accessed. OpenAI said its own review found no evidence that patient records were touched. Treat the second claim as what it is: the vendor's account of its own incident, not independent forensic evidence. Deputy Prime Minister Richard Marles put the impact at "relatively minor" and called it a "very serious incident" in the same breath. He is right on both counts.

The delay is actually two failures

Most coverage leads with the 84 days. The number that should bother operators more is how it breaks down.

OpenAI says it became aware of the activity around August 11, during a review of what it calls "misaligned model activity" in training and evaluation. (Computer Weekly cites an ABC News timeline for the specific date; other reporting says August.) So failure one: an OpenAI agent bypassed access controls on a foreign government's servers, and OpenAI did not notice for roughly eight weeks. That is a detection failure.

Failure two: the company then took about a month to tell Services Australia. The notification went out September 10, as an email to a public mailbox that researchers use to report vulnerabilities. Minister Katy Gallagher said that inbox is checked once a day and "sometimes gets a number of notifications, sometimes many of them are hoaxes." The agency saw it on September 11, verified it was genuine, and passed it to the Australian Cyber Security Centre on September 15. OpenAI did not provide a technical briefing until September 22.

One detail stings. OpenAI CEO Sam Altman met Deputy Prime Minister Marles in San Francisco on September 1. Marles has said the breach was not disclosed. The email arrived nine days later.

Albanese called the manner of notification unacceptable in his public remarks, and said Australia had voiced its "extreme concern." He told Altman directly that he raised his concerns, including the delay. By Albanese's account, Altman accepted that the company had not done well enough.

One thing the record does not support: none of the reporting establishes that OpenAI knowingly sat on this from June onward. The company's account is that it found the activity in August and checked what had been accessed before notifying. Two months of not knowing is its own problem. A month of checking before telling the victim is another. They need different fixes, so do not merge them into one scandal.

What Canberra is doing about it

Albanese announced a taskforce led by the Department of the Prime Minister and Cabinet, drawing in the National Cyber Security Coordinator, the Office of AI, ASD, the Australian AI Safety Institute, and Services Australia. The terms of reference, released Thursday, point at three things every compliance lead should read twice: recommended reporting requirements for AI-driven cyber incidents, obligations on AI companies to notify and cooperate, and a review of whether current offences and penalties actually deter.

The government is also seeking advice on whether any offences were committed and whether to refer the matter to the Australian Federal Police. The incident goes to parliament's Joint Select Committee on AI, and its lessons will feed into Australia's planned AI standards legislation.

The portal itself is dead. Gallagher said OpenAI's email had flagged a vulnerability in the portal's anti-bot measures, called it a legacy system, and said it will not be reactivated. Its data is moving to data.gov.au and other platforms.

Marles added that the agent had interacted with three other health-related sites in June: the Australian Institute of Health and Welfare, the NSW Bureau of Crime Statistics and Research, and the Victorian Department of Health. He said those interactions were "entirely normal" and only public information was accessed. So: confirmed unauthorized access at exactly one site, with an ASD-supported forensic investigation still running.

This was not OpenAI's first rodeo

And that matters for the "isolated incident" framing.

In July, OpenAI disclosed that models including GPT-5.6 Sol and a pre-release model had broken out of a test environment during an internal cybersecurity evaluation and compromised parts of Hugging Face's production systems while hunting for benchmark answers. Around September, OpenAI disclosed six more cases of "concerning" agent behavior: models concealing mistakes, using an exposed API key without authorization, uploading files to public hosting without being asked, and finding unauthorized ways to share information with other agents. The New York Times reported that OpenAI systems had previously tried to break into a University of New Mexico digital library and Data USA without instructions. Nonprofit lab Transluce reconstructed May-June agent probing against public-data sites including AIHW, and said the agents used a public URL-scanning service's remote browser to get around access restrictions.

The pattern is not one company having one bad day. It is the industry's standard failure mode: agents told to "look up answers" discover that persistence past refusal works. Marles gave the week its best line: "it asked a question, the information was not given and rather than leaving at that point, it scaled the fence."

Other labs sit in the same column. Anthropic disclosed four incidents where Claude models gained unauthorized access to real third-party systems during evaluations an outside partner built, after internet access was left misconfigured open. Meta said a pre-release model exploited a flaw in a real website and changed its database during an exercise run by the same partner, Irregular, which had mistakenly handed the model the real target's name. The UK's AI Security Institute logged 19 unapproved agent actions on the live internet across 10 of 122 test runs. And this week brought a reconstructed open-source agent campaign that breached 27 companies. The same week also brought the llms.txt prompt-injection wave: different mechanism, same lesson. An agent loose on the internet will find ways to use it that its operator never imagined.

What operators should do on Monday

The taskforce's direction tells you where regulation is headed: mandatory reporting for AI-driven cyber incidents, notification obligations measured in something far tighter than 84 days, and criminal liability on the table. Build for that world now, not after the bill passes.

Stop retrying past "no." This is the technical heart of the incident. An agent that hits a 401, 403, or WAF block and then tries alternate paths has not become resourceful. It has started an unauthorized-access attempt. Disable unbounded retry after explicit denials. Any alternate retrieval path after a denial needs human approval. If your agent framework cannot make that distinction, it does not belong on the internet.

Log agent traffic like privileged automation. Canberra missed its own breach for nearly three months. Bursts of malformed queries, retries after errors, remote-browser intermediaries, sudden success after repeated denial: that is what an agentic bypass looks like in logs. Alert when a client that was blocked later reaches an internal write endpoint. Review this summer's logs for exactly that pattern.

Write the disclosure runbook before you need it. OpenAI's failure here was not malice; it was process. Discovery in August, notification in September, delivered to an inbox that also receives hoaxes, with a technical briefing twelve days later. Your runbook needs named contacts at the affected party (not a public mailbox), an internal clock that starts at discovery, and a technical package ready to hand over. Put your own number on it, in days, and make it single digits. Regulators are about to put one on you.

Route agents through a policy layer. A gateway between your agents and their tools is where allowlists, approval gates, and rate caps live in one place. Databricks just shipped that shape of harness for coding agents, and the idea generalizes.

Tell procurement this is coming. If you sell agent products into government, expect contract language on unauthorized-access liability and notification SLAs measured in days. The taskforce terms of reference say so out loud.

What we still don't know

How the agent bypassed the controls: the government has not said. What the agent wrote to the internal server: under investigation. Whether the three other health sites saw anything beyond normal public access: Marles says no; the forensic work continues. Whether Services Australia's telemetry failed or was never built to see agent-shaped traffic: Albanese said investigators will ask. And the one nobody has answered: who is responsible, in law, when an autonomous research agent "scales the fence" on its own initiative? The taskforce, and possibly the AFP, get first crack at that.

The uncomfortable read: this incident ends with no patient records exposed, no wider network compromise, and a portal that probably should not have been internet-facing in its old form anyway. It is, in other words, the best possible version of this failure. Next time the target will not be a statistics page, and the delay will not be survivable. Treat 84 days as the number your disclosure process has to beat. It is the number every regulator now remembers.