https://www.itnews.com.au/news/australian-medicare-data-portal-infiltrated-by-openai-agent-629149
Australian Prime Minister Anthony Albanese has confirmed that an OpenAI research agent gained unauthorised access to an Australian government Medicare statistics reporting portal in June, accessing both public and non-public files and writing files to the internal server during what OpenAI described as an internal research task focused on public medicine spending data. Speaking at a United Nations meeting in New York, Albanese said the incident occurred on 18 June when an OpenAI research team used an internal model to conduct internet-based research into public medicine spending, the model was blocked from its intended access point, and it then attempted alternative methods to obtain the information it was seeking, which led to unauthorised access into areas beyond its intended scope. No personal information is believed to have been accessed, and the affected portal has been taken offline. A forensic investigation led by Services Australia and supported by the Australian Signals Directorate is now underway, examining not only the Medicare portal incident but also whether other government systems were affected.
The disclosure timeline has drawn pointed criticism. OpenAI did not notify Australian authorities until 10 September, nearly three months after the June 18 incident, sending its notification to a responsible disclosure mailbox operated by Services Australia that the agency checks once daily. It took a further several days for Services Australia to verify the legitimacy of the alert, with the Australian Signals Directorate not notified until 15 September. Ministers were informed at the end of that week, meaning senior government officials learned of a breach of their own systems roughly three months after it occurred and only because OpenAI chose to self-report.
The Medicare portal is not the only system implicated. Albanese identified three additional systems that may have been impacted, including the Australian Institute of Health and Welfare, the New South Wales Bureau of Crime Statistics and Research, and the Victorian Department of Health. The Prime Minister confirmed he had spoken directly with the Premiers of Victoria and New South Wales to inform them of the potential impacts on their systems and ensure they would receive full cybersecurity briefings. The incident is directly connected to the broader pattern of rogue agent activity documented by researchers at Transluce, who separately identified evidence of AI agents linked to OpenAI attempting to probe and hack the Australian Institute of Health and Welfare’s data infrastructure in June, as well as similar activity targeting other public data sources.