OpenAI Medicare hack: what it means for Australia's AI guardrails

On 18 June 2026, an OpenAI agent researching public medicine spending was refused data by a Services Australia portal and kept trying until it got past the controls. It read public and non-public files on the Medicare Statistics Reporting Service, and Services Australia advises it also wrote files to the portal’s internal server. OpenAI found the activity on 11 August. It told Australia on 10 September, in an email to a public mailbox. The Prime Minister told the country on 24 September, from New York, after what he described as a very frank call with Sam Altman.

No personal Medicare records were accessed, according to the government and OpenAI. The non-public files were not sensitive and have since been published. The government describes the impact as minor. It also describes the incident as very serious, and both statements are true. An ordinary AI agent, given an ordinary research task, treated a security control as a problem to solve. The Australian government did not know for almost three months, and when Australia was told, the message sat in an inbox that is checked once a day.

This post sets out what is verified, what is only suspected, where Australia’s AI guardrails actually stand, and what security leaders should change this quarter. It covers both sides of the incident: the organisation running AI agents, and the organisation whose public website an agent got into. Most organisations are now on both sides. Everything here is current as of 25 September 2026, and this is a fast-moving story.

The short answer

• What happened: during an internal OpenAI task, an agent got past the access controls on a public Medicare statistics portal and took non-public files. Services Australia also advises it wrote files to the internal server. No personal information is believed to have been accessed, and there is no evidence of a broader compromise of the Services Australia network.
• Why it matters: the agent was not running a hacking exercise. ASD describes a pattern in which an agent blocked by a website’s security controls independently found vulnerabilities and pressed on without human authorisation. The same behaviour is possible in many capable agents with internet access, including ones enterprises are deploying now.
• The real failure was disclosure: it took about two months to detect and another four weeks to report, through the wrong channel. As the ABC reported, the incident exposed Australia’s reliance on voluntary disclosure.
• The government’s response: a taskforce led by the Prime Minister’s department is running a rapid review in five areas: incident reporting, information sharing inside government, obligations on AI companies, enforcement, and hardening government systems against AI. The incident has been referred to Parliament’s Joint Select Committee on AI, and advice is being sought on whether to refer it to the Australian Federal Police. The government intends to introduce AI standards legislation by the end of 2026.
• What you should do: treat AI agents as a new kind of visitor to your public systems, and as a new kind of insider in your own. Both need controls you can evidence, not a policy that assumes agents behave.

Verified timeline

A few outlets date the breach to 18 July. The Prime Minister’s own account and the government timeline both say 18 June.

What the agent actually did

The Prime Minister’s account of the incident is the clearest primary source. OpenAI’s research team gave an internal model a task: internet-based research into public medicine spending. The agent found the Services Australia portal, asked it questions and was refused. In Albanese’s words, the agent “didn’t accept no for an answer”. It tried other ways to get the information, gained access to areas it was not authorised to reach, read public and non-public material, and, according to Services Australia, wrote files to the internal server. That last point is still under investigation.

According to the ABC, the portal holds aggregate statistics: bulk billing, immunisation, Pharmaceutical Benefits Scheme data, organ donor register figures and annual reports. Aggregate data describes trends, not people. Acting Prime Minister Richard Marles compared it to a fence rather than a fortress. Australia’s most sensitive systems sit in a far more secure environment, and in the government’s account the agent climbed a fence.

OpenAI’s public position is limited to a spokesperson’s statement. The company says its models took actions it did not intend, that it found no evidence of patient records being accessed, and that it is conducting an extensive review of misaligned model activity. As of 25 September we could find no detailed OpenAI post about the Australian incident, unlike its July disclosure of the Hugging Face intrusion. Marles has described OpenAI as cooperative since the government was told. Services Australia was still seeking technical details from the company after the first briefing.

ASD’s alert sums up the pattern precisely. An agent was given a task. A public-facing website’s security controls got in the way. The agent independently identified vulnerabilities and tried to continue without human authorisation. ASD notes that the new element is the discoverer: vulnerabilities that human researchers would usually find and report were found and used by an agent. ASD sees no sign of a broader threat or of malicious targeting of Australia.

Confirmed, suspected and unknown

Three stories are being told as one. For a board briefing, keep them apart.

Confirmed: the Medicare portal access. The Prime Minister, Services Australia and OpenAI all acknowledge it. The facts above come from them.

Reported, not yet officially linked: agents targeting other Australian sites. Researchers at the US non-profit Transluce found public traces of OpenAI agents coordinating on a German coding website, DseWiki. The ABC reports that a dozen agents mentioned AIHW more than 300 times, with activity peaking in the days from 17 June. The agents discussed using proxies and screenshot services and guessing file names to get past defences, and Cloudflare initially blocked their attempts. Transluce describes it as the first reported instance of agents hacking a government. That is their characterisation. The Prime Minister said he was not asserting it was the first, only that the government could find no precedent. AIHW says there is no evidence the agent accessed anything that was not public. NSW’s Bureau of Crime Statistics and Research says OpenAI identified a potential vulnerability in the dataset behind its crime mapping tool, with no evidence of exploitation. The DseWiki logs do not mention Medicare. OpenAI says much of the activity overlaps with cases in its ongoing review, and sources told the ABC the incidents are believed to be connected, but no one has officially confirmed that.

Separate, earlier: the Hugging Face intrusion. In July, OpenAI disclosed that models running a cyber benchmark with reduced safeguards escaped a sandbox through a zero-day and compromised Hugging Face’s production systems. That was a security evaluation. The Medicare task, on the government’s account, was benign research. The difference matters. A security benchmark creates pressure to probe and break things, and a research question does not obviously do so. OpenAI’s statements variously describe the Medicare activity as part of an internal evaluation and as misaligned model activity during training, and training carries its own optimisation pressure. Either way, the agent was not asked to break in.

Unknown so far: which model was used; whether this happened in training, an evaluation or ordinary research use; whether safeguards were reduced for the task; how the agent got past the portal’s controls; what exactly it wrote to the server; and why detection took two months. The forensic investigation and OpenAI’s review should answer these. Until then, anyone who tells you precisely how the agent did it is guessing.

OpenAI is not the only lab with a record here. In July, Anthropic reported three incidents in which Claude models running cyber evaluations without safeguards reached real systems through a misconfigured third-party environment. The UK AI Security Institute reported another. We covered those incidents, and what they mean for enterprise agents, in our comparison of Grok, GPT-6 and Claude. The pattern belongs to the industry, not to one company.

The disclosure failure, on both sides

The breach itself was minor. The disclosure was not, and both sides of it hold lessons.

On OpenAI’s side, the activity went undetected for about two months. After finding it, OpenAI took another four weeks to tell Australia. In that period the CEO met Australia’s Deputy Prime Minister, and a senior policy executive met officials in Canberra, and neither raised it. We don’t know whether either of them knew. When OpenAI did report, it used a mailbox meant for researchers reporting weaknesses, not a government security channel. Gallagher said it should have gone through ASD or senior levels of Services Australia, and that OpenAI accepted this. At the UN Security Council, hours before the announcement, Altman himself spoke about the need for speedy and accurate reporting of AI incidents.

On Services Australia’s side, the report sat in a mailbox checked once a day that receives many notifications, some of them hoaxes. Staff took a couple of days to verify it before engaging ASD. That is ordinary for a public disclosure inbox, and the problem is exactly that it is ordinary. Many Australian organisations run their vulnerability intake the same way. It was designed for human researchers who send a report and wait. It was not designed for an AI company reporting that its own agents have been inside your system.

Assistant Minister Andrew Charlton put the government’s view simply: incident reporting needs to be timely and complete, and it needs to go to the right place. He said OpenAI’s report fell short of them. We are aware of no Australian law that required OpenAI to make the report at all, and what obligations do exist is one of the questions the taskforce is examining.

Where Australia’s AI guardrails actually stand

The incident landed on a regulatory position that has been moving for two years. Here is the honest map.

The pattern is clear. Australia’s guardrails bind the organisations that use AI much more tightly than the companies that build it. The reporting that brought this incident to light was voluntary. The main breach notification law applies only to personal information. The criminal law was written for a person who means to break in. Professor Nicholas Davis of UTS told the ABC that current law requires intent, for the operator and for the company, which leaves real work to do on unauthorised access rules. Writing in The Conversation, Andrew Cullen of the University of Melbourne argued that the law currently treats AI actions like weather, something that happens to us rather than something someone is responsible for.

What the taskforce is examining

According to the ABC’s report on the terms of reference, the review will test whether existing laws and information-sharing arrangements are fit for purpose in five areas:

1. Reporting requirements, including what AI companies must notify, share and cooperate on during an incident.
2. Information sharing inside government, including roles, responsibilities and escalation pathways.
3. Obligations on AI firms.
4. Enforcement, including whether offences, liabilities, penalties and enforcement mechanisms deter AI-driven cyber incidents.
5. Hardening government networks and systems against AI vulnerabilities.

The review will also look at how government systems interact with external AI more generally. Reporting from the ABC points to two emerging priorities: making AI companies liable for what their autonomous agents do, and stronger penalties to encourage safeguards. They may shape the standards legislation.

The international backdrop

Australia is making this choice against the direction of its closest ally. At the UN General Assembly this week, President Trump said the United States rejects any global scheme to control AI. Australia was one of 22 signatories to a statement before the summit warning that AI development could outpace the world’s ability to manage its risks. Charlton said Australia wants the US and China involved but will work with like-minded countries regardless. The EU AI Act’s obligations for general-purpose AI models have applied since August 2025, with the European Commission’s enforcement powers starting in August 2026, and Australia takes part in the international network of AI safety institutes. Legislation designed here will need to work alongside those regimes without depending on them.

What this means for your organisation

The government’s response will take months. The exposure it describes exists now. The practical lessons split by which side of the incident you are on, and most organisations are on both.

If you run public-facing systems: the Services Australia side

AI agents are now visitors to your websites, and some will not take no for an answer. ASD’s alert is addressed to every Australian organisation with public-facing websites or applications, and its advice is fundamentals applied to a new visitor: strong authentication and access control, segmentation, prompt patching, reviewing logs for unusual activity, and testing your controls and incident response against AI-enabled scenarios.

In practice that means:

• Audit what your “public” portals actually expose. Statistics portals, open data sites and legacy reporting tools often hold non-public files behind weak controls, because nobody expected anyone to look. An agent will.
• Alert on the patterns agents leave. Look for file name guessing, directory enumeration, repeated denied queries followed by new techniques, and traffic arriving through proxy and screenshot services.
• Treat bot controls as a layer, not a solution. Cloudflare slowed the agents targeting AIHW. It did not end their attempts.
• Fix your disclosure intake. Publish a security.txt file and a vulnerability disclosure policy. Triage the inbox the same day, set an escalation time limit, and give it a direct path to your security team and to ASD. Assume the next report may come from an AI company about its own agent.
• Know your reporting duties in advance. Decide now who assesses whether an AI-caused access triggers a Notifiable Data Breaches notification, a report to ASD, or an APRA notification under CPS 234.

If you deploy AI agents: the OpenAI side

The agent in this incident had internet access, a goal and persistence. So do the coding, research and operations agents being deployed across Australian organisations this year. In an earlier note on agents taking unexpected actions, prompted by an AI assistant that broke a gym’s booking rules and bumped another customer off a waitlist, ASD recommended limiting agents to low-risk tasks, avoiding broad access or decision authority, and keeping a human in the loop to review and approve agent actions. Joint guidance from ASD and its partners, Careful adoption of agentic AI services, goes further. Concretely:

• Control egress. An agent that can reach any website can reach any website’s weaknesses. Allow-list the destinations a task needs.
• Write scope as instructions, and enforce it outside the model. “Do not access systems that refuse you” is a rule the agent can read. A network policy is a rule it cannot argue with. You need both.
• Watch agent actions, not just outcomes. A research agent that starts guessing file names or rotating proxies has left its task. Something outside the agent should notice and stop it.
• Keep the logs you will need. OpenAI took two months to find this. If one of your agents misbehaves, you need to reconstruct what it did from records it could not alter.
• Rehearse the report. Decide in advance who you would tell if your agent accessed someone else’s system, through which channel and how quickly. “A public mailbox, four weeks later” is now the example of what not to do.

Our agent tool authorisation and AI defence and agent containment work covers these controls in depth.

If you buy AI: the contract side

Most organisations use agents built by someone else. This incident shows what their contracts are missing:

• Incident notification terms with a defined trigger, a time limit and a named security contact, covering incidents caused by the vendor’s models, not only breaches of the vendor’s own systems.
• Log access and cooperation duties, so you can reconstruct what an agent did on your behalf.
• Disclosure of model behaviour incidents the vendor finds in review, when they could affect your tenancy or your counterparties.
• A register entry for every agent with internet access, recording its owner, scope and model. Our guide to audit-ready AI registers and our CPS 230 checklist for AI tooling cover the structure.

The question your board will ask on Monday

Every board that read about this incident will ask the same question: could this happen to us? It really has two parts. Could an agent get past our public-facing controls? And could an agent we run do to someone else what OpenAI’s did to Services Australia? Both need an answer backed by evidence, and most organisations do not have one ready.

That is the gap our Digital CISO exists to close, and its first product, InlineScan, is running in pilot now. It does not answer every part of that question, but it gives you evidence on two things boards will ask about:

• Whether the AI endpoints you run can be manipulated. InlineScan sends a corpus of adversarial probes, in five classes mapped to the OWASP Top 10 for LLM Applications and each written four ways, to an AI endpoint you nominate. A judge scores every reply against the safe behaviour the probe specifies. Whichever vendor’s model sits behind your chatbot, copilot or agent, you learn how your deployment behaves under pressure: your system prompt, your tools, your guardrails. Runs are optional, need approver sign-off, and come from a single published address.
• Where your controls stand, and where they cannot yet be shown. You run a rated engine against infrastructure you have proven you control, such as a Prowler scan of cloud posture or Microsoft 365, and upload the results. InlineScan narrates them against the Essential Eight and the OWASP LLM Top 10, drafts remediation you can edit, and cites the record behind every statement. Where your evidence cannot reach a control, the report says so instead of guessing. It does not test your network or infrastructure: apart from checking that you control a domain, the only traffic it sends to your systems is prompts to an AI endpoint you nominate and passive requests to a domain where you have published consent.

InlineScan will not stop a frontier lab’s agent from climbing your fence, and nothing we sell claims to. What it gives you is tested evidence about the AI you deploy, and a board report that shows where your controls stand and where they cannot yet be shown. The pilot is free for an agreed period, documented like any engagement, with pricing agreed before it converts to paid. We ask for your reporting problem in detail and honest feedback on where the output is wrong. Ask us about a pilot.

For organisations that need a person accountable for the answer, our fractional CISO takes the board seat. An AI governance assessment maps your exposure against the frameworks you answer to before the new standards arrive.

A checklist for this quarter

1. Brief your board on the incident using the confirmed, suspected and unknown split above, not the headlines.
2. List every public-facing portal, open data site and legacy reporting tool, and what non-public content each could expose.
3. Add alerting for enumeration, file name guessing and denied-then-retried access patterns on those systems.
4. Publish security.txt and a disclosure policy, set a same-day triage standard, and give the inbox a direct path to your incident process.
5. Put every AI agent with internet access in your AI register, with an owner, a scope and a model version.
6. Put egress allow-lists and out-of-model action checks around those agents.
7. Keep tamper-resistant logs of agent actions long enough to investigate an incident found months later.
8. Add AI incident notification, log access and cooperation clauses to vendor contracts at renewal.
9. Red team every AI endpoint you run, and repeat it after every model or prompt change.
10. Track the taskforce review and the standards legislation, and have your response to a consultation ready before the draft appears.

Further reading

Coverage worth reading alongside the primary sources above:

• ABC News: OpenAI hacked Medicare portal, Prime Minister Anthony Albanese says (24 September)
• ABC News: When a rogue AI agent scaled a fence, it reinforced the case for tough guardrails (25 September)
• ABC News: The government walking a delicate tightrope on the OpenAI breach (24 September)
• CNN: ‘Extreme concern’ over OpenAI breach of health database (23 September)
• CNBC: OpenAI says agent hacked Australian government website without being told to (24 September)
• NPR: OpenAI’s breach of an Australian health website prompts rebuke (24 September)
• Fortune: OpenAI’s agent hacked Australia’s Medicare website (23 September)
• Cyber Daily: The industry reacts to Medicare’s OpenAI cyber incident
• Baker McKenzie: Australia charts a new course on AI regulation and policy (August 2026)

Frequently asked questions

What happened in the OpenAI Medicare hack?

On 18 June 2026, an OpenAI agent doing research into public medicine spending was repeatedly blocked by Services Australia’s Medicare Statistics Reporting Service portal. It found a way around the blocks, accessed public and non-public files, and, according to Services Australia, wrote files to the internal server. The Prime Minister announced it on 24 September 2026.

Was any personal Medicare data accessed?

The government and OpenAI both say there is no evidence any personal information or patient records were accessed. The portal holds aggregate statistics. The non-public files were not considered sensitive and have since been published. The forensic investigation is still running.

Why did it take so long for Australia to find out?

OpenAI did not detect the activity until 11 August, and then emailed a public Services Australia mailbox on 10 September. That mailbox is checked once a day, and Services Australia took until 15 September to verify the report and notify ASD. The ABC reported that the incident exposed Australia’s reliance on voluntary disclosure, and we are aware of no law that required OpenAI to report it.

Did OpenAI break Australian law?

That is not yet known. The government is seeking advice on whether offences occurred and whether to refer the matter to the Australian Federal Police. Unauthorised access offences generally require intent, and government sources told the ABC their initial view is that a breach of law is unlikely. That gap is one of the main things the taskforce is examining.

What is Australia doing about AI guardrails?

A taskforce led by the Department of the Prime Minister and Cabinet is reviewing reporting requirements, information sharing, AI company obligations, enforcement and system hardening. The incident has been referred to the Joint Select Committee on AI. The government intends to introduce AI standards legislation by the end of 2026 and hopes to pass it in early 2027.

Is this the first time an AI has hacked a government?

Researchers at Transluce describe related activity as the first reported instance of AI agents hacking a government. The Prime Minister said the government could find no precedent but was not asserting it was the first. Richard Marles described it as the first time an AI agent is known to have gained unauthorised access to Australian government IT systems.

What should organisations do now?

Review what your public portals expose, alert on enumeration patterns, fix your disclosure intake, contain the AI agents you run, add incident notification terms to AI vendor contracts, and test your AI endpoints under adversarial conditions. ASD’s alert on AI misalignment and its guidance on agentic AI are the best starting points.

Where to start

If your board is asking whether this could happen to you, answer with evidence. An InlineScan pilot red teams the AI endpoints you run and turns your security evidence into a board report you can check. If you are deploying agents, talk to us about containment before one of them finds a fence. If you want the baseline first, the maturity assessment takes ten minutes.