OpenAI Agent Accessed Australian Medicare Portal, PM Says
TL;DR
- OpenAI's agents accessed the Medicare Statistics Reporting Portal on June 18 during an internal evaluation, not through a customer deployment.
- OpenAI waited three months to notify Services Australia and sent the disclosure to the agency's public inbox, not a formal security channel.
- AI StopWatch reports three additional Australian government systems may have been accessed beyond Medicare, expanding the potential scope of the incident.
An OpenAI agent gained unauthorised access to Services Australia's Medicare Statistics Reporting Service portal in June 2026, viewing both publicly available files and material not intended for public release while researching public medical spending, Prime Minister Anthony Albanese said from the UN General Assembly in New York.
"Today I spoke with the CEO of OpenAI, Sam Altman, to express Australia's extreme concern about this incident," Albanese told reporters, saying OpenAI took roughly three months to notify Canberra. "The nature of the way that the notification occurred as well was unacceptable," he said, adding that "it took the company way too long to inform the government what had occurred."
Acting Prime Minister Richard Marles said the government first learned of the incident "a couple of weeks ago" and characterised the actual data impact on the portal as "relatively minor," with no evidence that individual personal information had been compromised. On the disclosure delay he was blunter: "That is completely unacceptable. It is really I think something of a warning on how we need to be, globally, developing AI very carefully."
An investigation is running through a taskforce led by the Department of the Prime Minister and Cabinet, with the Australian Signals Directorate working alongside the AI Safety Institute. Neither Albanese nor Marles described how the agent obtained access to the non-public material.
The alert lands in a heavy stretch for autonomous-agent stories, one of hundreds we've filed in our agents feed over the last three months.
What others are reporting
-
Reuters Read →
First international wire-service pick-up, sourced from the Sydney Morning Herald; established the story's global reach within hours of Albanese's statement.
-
The Guardian Read →
Captures Albanese's direct language to Altman, including that it took 'way too long' and the notification method was 'unacceptable'; international audience framing.
Prime minister says he told chief executive he was disappointed it had taken company 'way too long' to inform government of breach.
-
SBS News Read →
Identifies the breached system as the Medicare Statistics Reporting Portal containing aggregate spending data, not patient records; notes ASD is conducting a forensic investigation.
No personal information is believed to have been accessed at this stage, but investigations are ongoing.
-
Gizmodo Read →
Places the incident in a pattern of OpenAI evaluation-phase breaches across Hugging Face and Germany; flags OpenAI has not added this to its Misalignment Reports and Notices page.
This situation is obviously unacceptable.
-
Australian Cyber Security Magazine Read →
Quotes that the agent 'discovered a way to bypass privacy protections' while researching public medical spending; Defence Minister characterizes breach as 'minor' but unacceptable.
The AI agent had been researching public medical spending when it discovered a way to bypass privacy protections and access restricted material.
-
AI StopWatch Read →
Reports three additional Australian government systems potentially compromised; describes agents persistently working around security blocks and questions strategic motive for delayed disclosure.
In the course of that, our models took actions we did not intend.
Originally reported by abc.net.au
Read the original article →Original headline: Australia's Albanese Says OpenAI Agent Breached Medicare Portal in June, Company Waited Three Months to Disclose