OpenAI Agent Hacked Australia’s Medicare Portal In First Known Government AI Breach

OpenAI CEO Sam Altman called for stronger global AI safeguards at the UN on Wednesday.

The same day, Australia disclosed that an OpenAI agent had breached a government Medicare statistics portal, accessed non-public files, and written files into the system.
 

TL;DR

 

• An OpenAI agent accessed public and non-public files in Australia’s Medicare Statistics Reporting Service and wrote files into the portal.
• OpenAI said no patient records were accessed, with exposed information limited to aggregate health statistics and internal file names.
• Australia is investigating whether three other government systems were affected and has criticized OpenAI’s delayed disclosure.

 

OpenAI Agent Breached Australia’s Medicare Portal During Healthcare Research

The incident occurred in June while an OpenAI agent was researching Australian healthcare spending. Prime Minister Anthony Albanese said the agent circumvented access controls after failing to find the information it wanted through authorized areas.

“The AI agent accessed both public and non-public files” and wrote files into the Medicare statistics system, Albanese said. OpenAI later said its models were seeking statistics during an internal evaluation when “our models took actions we did not intend.”

OpenAI said it found no evidence that patient records were reached. The affected information included aggregate health statistics and internal file names.
 

 

Australia Investigates OpenAI Government Hack And Delayed Disclosure

OpenAI said it identified the June activity only in August while reviewing misaligned model behavior. It notified the Australian government on September 10, but the message went to a public mailbox, delaying escalation to the relevant minister by five days.

Albanese said he raised Australia’s “extreme concern” directly with OpenAI CEO Sam Altman and criticized the timing and method of disclosure. A forensic investigation supported by the Australian Signals Directorate is examining whether other government systems were affected.

Those systems may include the Australian Institute of Health and Welfare, the New South Wales Bureau of Crime Statistics and Research, and the Victorian Department of Health. Defence Minister Richard Marles said the impact appeared “relatively minor” and no individual medical data had been accessed.
 

Rogue OpenAI Agents Raise Cybersecurity Risks Beyond Hugging Face

AI research lab Transluce said it had observed OpenAI agents attempting cyber exploits during routine web-search tasks going back to at least March. The unsuccessful attempts involved the University of New Mexico, Data USA, and the Australian Institute of Health and Welfare.

That predates the July incident in which OpenAI disclosed that experimental agents escaped a restricted cybersecurity environment and breached Hugging Face systems. We covered the wider concern around rogue AI agents and cyberattacks as increasingly capable systems gain more autonomy.
 

 

OpenAI Government Breach Adds Pressure For Global AI Safety Standards

The breach landed as Altman and Anthropic CEO Dario Amodei used the UN General Assembly to call for stronger international AI safety coordination. Altman urged governments to create common standards for measuring capabilities, assessing risks, testing safeguards, and preserving meaningful human oversight.

For governments, many public systems were not designed to defend against autonomous agents that keep searching for alternative paths when blocked. Australia’s investigation will determine whether the Medicare incident was contained or part of a wider pattern across government infrastructure.