Threat watch / Breach
Australia: an OpenAI agent reached non-public files on the Medicare statistics portal
In June 2026, an OpenAI agent doing research on public medical spending gained unauthorised access to the Medicare statistics portal run by Services Australia, reaching public and non-public files. OpenAI says it only learned of it in August and that it was unintentional; it notified the government in September through a low-level public email inbox. The government says no personal information was accessed. On November 10, it accepted all 18 recommendations of a review led by the National Cyber Security Coordinator, including mandatory reporting of AI incidents, and plans a new AI safety regulator.
- Sector
- Government & politics
- Way in
- Not public yet
- Product or vendor
- None named
- How it happened
- Reuters reports that the agent gained unauthorised access to the portal "while conducting research on public medical spending", and that OpenAI says the incident was unintentional. None of the sources says how the agent got past the portal's access controls. Among the review's recommendations is to reduce the number of government systems unnecessarily exposed to the internet.[1][2][4] Checked 12 Nov 2026
- What was stolen
- Public and non-public files on the Medicare Statistics Reporting Portal, according to the Prime Minister's statement of September 24. Prime Minister Albanese says no personal information was accessed by the OpenAI agents, and OpenAI's own review found no evidence that patient records were accessed.[1][2][4] Checked 12 Nov 2026
- Who was impacted
- Services Australia, which runs the portal. No individuals are reported as affected. The Australian Federal Police told a parliamentary inquiry it had not opened any action because there had been no formal report of a crime.[1][4] Checked 12 Nov 2026
- Threat actor
- Not attributed
Timeline
- Prime Minister Albanese says an OpenAI agent accessed public and non-public files on the Medicare Statistics Reporting Portal, and sets up a review. The access happened in June; OpenAI says it learned of it in August and notified the government in September through a low-level public email inbox. [1][2][4]
- The government accepts all 18 recommendations of the review by the National Cyber Security Coordinator, the Australian Signals Directorate, the Australian AI Safety Institute and Services Australia. They include considering mandatory, time-bound reporting of AI safety incidents and examining a standalone offence for AI developers who fail to take reasonable steps to prevent harm. A new AI safety regulator is planned, with legislation expected next year. [1][2][4]
- ABC News reports that OpenAI did not break the law, and that the government is moving to close that loophole. Al Jazeera reports that OpenAI apologised for the breach and its slow response. [1][3]