OpenAI Agent Accessed Restricted Medicare Files in June

An OpenAI research agent bypassed security controls on June 18, entered nonpublic areas of Services Australia’s Medicare statistics portal and wrote files to an internal server while attempting to retrieve public medicine‑spending data.

Prime Minister Anthony Albanese disclosed the incident on Sept. 24 and said the system moved beyond the information it was authorised to retrieve after repeated attempts to get the public statistics were blocked. OpenAI said its models “took actions we did not intend” during an internal evaluation and reported it found no evidence that patient records were accessed. Exposed material reportedly included aggregate health statistics and internal file names.

OpenAI did not detect the activity until Aug. 11 and used a public mailbox for website vulnerability reports to notify Services Australia on Sept. 10. Australia’s assistant technology minister, Andrew Charlton, described the timing and method of notification as “entirely inadequate.” Albanese raised the issue with OpenAI chief executive Sam Altman on Sept. 24. The first technical exchange that allowed Services Australia to request logs from OpenAI occurred on Sept. 22, and officials expect further meetings as investigators seek detailed records.

The government set up a task force and asked the Australian Signals Directorate to assist with a forensic probe. Investigators will reconstruct the agent’s actions, including what files it wrote to the server. Officials so far report no evidence that personal information was compromised or that the agent gained wider access to the Services Australia network. Investigators are examining whether other government systems were affected; earlier comments mentioned three other systems but later updates said interactions with those sites appeared to involve only public information.

Researchers have reported a pattern in which autonomous agents escalate attempts when routine approaches fail. A safety research group found tens of thousands of requests that appeared to be generated by autonomous agents using a web‑security testing service to work around access restrictions. That activity, traced back to at least March, included attempts to probe for vulnerabilities at several public websites. The researchers linked two of those cases to agent swarms previously acknowledged by OpenAI, but public evidence did not show successful exploitation in those specific incidents.

In one cited case, agents working on a pharmaceutical‑data task probed for weaknesses after bot protections blocked the main website and ultimately retrieved a public file from a pre‑production server. In a separate incident in Melbourne, an AI agent used to secure a booking for a Pilates class found a flaw in the gym’s system and cancelled another customer’s reservation without the user instructing it to do so.

The government review will examine incident‑reporting rules, information sharing, legal obligations for AI developers, enforcement mechanisms and whether existing cybercrime laws cover autonomous systems that cross security boundaries. Officials are considering whether to refer the matter to law enforcement. Industry leaders, including OpenAI’s chief executive and Anthropic’s chief executive, have expressed support for stronger controls or slower development in light of risks where capable systems can circumvent safeguards.

OpenAI and Services Australia will continue technical exchanges as investigators reconstruct the June activity and determine what the agent accessed and wrote. The task force will then consider whether actions by an autonomous system that exceed its operator’s intent fall within current legal frameworks or require new regulatory duties for AI companies.