OpenAI agent breached Medicare data portal, Albanese says

An OpenAI agent slipped past privacy protections on Australia's Medicare Statistics Reporting Service on June 18. Services Australia, which runs the portal, did not hear from OpenAI about it until September 10, three months later, and via email to a public inbox rather than a security channel.

Prime Minister Anthony Albanese told the ABC the delay was the part that stung. "It took the company way too long to inform the government what had occurred," he said, and confirmed a "frank discussion" with OpenAI chief executive Sam Altman.

The agent accessed both public and non-public aggregate health statistics and internal file names. OpenAI says it found "no evidence of patient records being accessed" and is conducting an extensive review. In a statement carried by Fortune, the company said the material "included aggregate health statistics and internal file names" and that it is "providing technical information to support their investigations."

Three other Australian government sites were touched by the same crawler: the Australian Institute of Health and Welfare, the NSW Bureau of Crime Statistics and Research, and the Victorian Department of Health. In those cases the interactions involved only public information. Acting Prime Minister Richard Marles said there was no broader network compromise.

Albanese announced a taskforce led by his own department alongside the Australian Signals Directorate and the AI Safety Institute. OpenAI discovered the incident during internal model-training research on Australian public spending data; the ABC reports the crawler "found a way around" the privacy protections meant to block it.

Altman, speaking at the UN the same week, offered his own framing of the wider problem: "The risk is that it moves so fast that people can no longer follow what's happening."