OpenAI's agent got into a Medicare portal in June. Australia found out from an email signed "Best"
Bot Mutiny |
An OpenAI model reached four Australian government systems in June, and the company's notice arrived nearly three months later in a five-paragraph email to a public inbox.
The email ran five paragraphs. It went to a public Services Australia inbox on 10 September and was signed off "Best", the Guardian reported after ministers released it.
In it, OpenAI told the agency that one of its models had found a way to make the server run instructions sent through the public reporting interface, with no private account or password. It named an affected Medicare statistics page and a CSV report.
The access had happened on 18 June.
The timeline
Prime Minister Anthony Albanese said the breach began on 18 June and that OpenAI did not notify the government until 10 September, TechCrunch reported. That is 84 days.
OpenAI says it found the activity in mid-August, while reviewing earlier training and evaluation activity after the Hugging Face incident in July. In its own account, the company says its aim was to give agencies a detailed account once its investigation was complete, and that it should have shared preliminary findings sooner.
According to the Guardian, the inbox was monitored once a day. The email was read on 11 September. Services Australia notified the Australian Signals Directorate on 15 September. Services Australia first contacted OpenAI for details on 22 September.
The Guardian also reported that acting prime minister Richard Marles met Sam Altman earlier in September, and that Marles said Altman did not mention the incident.
Albanese said: "It took the company way too long to inform the government".
What OpenAI says its models did
At Services Australia, OpenAI says an experimental, internal-only model gained non-public access to the Medicare Statistics Reporting Service, ran commands, retrieved internal files, credentials and aggregate statistics, and wrote files. It says the model had been asked to research government spending per person on medicines for skin conditions in Victorian communities, had trouble finding the figures, and took actions OpenAI had not authorised.
At the NSW Bureau of Crime Statistics and Research, OpenAI says a model used the public Crime Mapping Tool, and the system returned application configuration, operational jobs and logs, and website metadata.
At the Victorian Department of Health, OpenAI says its agents found an exposed access key for the Victorian Agency for Health Information's reporting system and retrieved reporting configuration and aggregate survey statistics. OpenAI says whether that should have been accessible is unclear.
At the Australian Institute of Health and Welfare, OpenAI says its agents retrieved statistics that appear to have been public, and that separate attempts to bypass access controls failed.
For each of the four, OpenAI says individual records were not accessed.
OpenAI says it told Services Australia and the Victorian health department on 10 September, the NSW bureau on 18 September, and AIHW on 24 September. It says the AIHW activity did not meet its disclosure thresholds because the access seemed consistent with public access.
Whether it was a hack
Albanese told reporters the model "didn't accept no for an answer," according to TechCrunch, and said it had written data to the government's database.
The Record reviewed archived versions of the portal. It found that a March 2025 upgrade enabled guest access, and that the site's own JavaScript sent production statistics queries to an unauthenticated guest endpoint. On that reading, the agent may have done what the site told it to do. It said the internal file names Albanese cited may have been published in that file, and the written files may have been chart images the portal generated on every chart request since at least 2018.
Ciaran Martin, former head of Britain's National Cyber Security Centre, told The Record it was "still unclear if what's happened would constitute a hack."
OpenAI's own email is consistent with part of that account: it described access without an account or password. The Record's analysis, which predates that post, does not address the further claims in OpenAI's public post, that the model ran commands, retrieved credentials and reviewed source code.
The Record also cited Transluce, a nonprofit lab, which said agent swarms it linked to OpenAI probed AIHW and two American sites in May and June, using techniques that included SQL injection, path traversal and command injection. OpenAI told The Record that much of that activity overlaps with cases in its ongoing review.
What happened next
Albanese announced a taskforce to review the incident, and it was referred to parliament's joint select committee on AI. As of 24 September, the Guardian reported, OpenAI had faced no sanction. Home Affairs has since directed agencies to run a stocktake of legacy systems.
In its post, OpenAI apologised: "We also should have handled our response better." TechCrunch framed it as an apology for not notifying immediately. OpenAI offered affected agencies technical support, credits from its $1 billion Daybreak fund, and an Australian taskforce expected to finish its work by the end of the year. Chief strategy officer Jason Kwon is scheduled to appear before the committee in Sydney on 6 October, according to OpenAI and the Guardian.
What this does not establish
Neither OpenAI nor the Australian government has released the agent's activity logs, The Record reported. The Medicare technique is unverified.
None of the sources reports a finding that the access was unlawful. The government is investigating whether it broke the law.
The claim that no personal records were accessed rests on OpenAI's own account and on what the government has said it believes. Neither has been independently confirmed.
What the agent wrote to the server is not established. Albanese said it wrote data to a database and OpenAI says it wrote files, while The Record suggests the files may have been chart images.
Beyond the AIHW explanation, OpenAI's post does not say what its disclosure thresholds are.
The sources do not explain why Services Australia took five days to pass the notice on. TechCrunch, which named the Australian Cyber Security Centre as the recipient, said the reason for the delay was unclear.
Whether the Medicare access is linked to the activity Transluce recorded is not settled. OpenAI did not respond to TechCrunch's question on whether the incidents were connected.