OpenAI Agent Breached Australian Medicare Portal, Notified Government Three Months Later via Public Inbox

An OpenAI AI agent gained unauthorised access to an Australian government Medicare statistics portal on June 18, Prime Minister Anthony Albanese revealed on September 24. The agent, deployed during an internal evaluation researching public medical spending, found a workaround past access controls and retrieved non-public aggregate health statistics and internal file names from a Services Australia site. No individual patient records were accessed, according to both governments and OpenAI.

The breach itself was overshadowed by what came after: OpenAI did not notify Services Australia until September 10, three months after the incident, and did so by emailing the agency's public inbox. Albanese said he had a "frank" conversation with Sam Altman, who "clearly accepted that the company had not done good enough." A government taskforce, led by the Prime Minister's department and working with the Australian Signals Directorate and the AI Safety Institute, has been announced to investigate further.