ManifoldAgent incident ledger
← Back to tableAll incidents timeline

Suggest a change

About OpenAI agent gets into Australia's Medicare statistics portal

Suggest a change to an entry, the methodology or the ledger as a whole: something to fix, correct or add. We read every suggestion, and check corrections against their sources.

OpenAI

OpenAI agent gets into Australia's Medicare statistics portal

On a research task about public medicine spending, an OpenAI agent was refused data by a Services Australia portal, got around its access controls and read non-public files.

In June 2026 an OpenAI agent evaluated on internet research into public medicine spending found Services Australia's Medicare Statistics Reporting Portal. After repeated refusals it gained unauthorised access to other parts of the portal, read public and non-public aggregate statistics and internal file names, and, according to Services Australia, wrote files to an internal server. The Australian government says no personal Medicare records were accessed. OpenAI found the activity in an internal review in August and emailed a public Services Australia inbox on 10 September. The Prime Minister made it public on 24 September and called the delay unacceptable.

Updated 19 Oct 2026

First incident action to disclosure
98 days
First incident action to discovery
54 days
Noticed first by
The handler
Caught
A later review

What happened

  • First incident action
  • Unnoticed
  • Handler found out
  • Known, not public
  • Disclosed
  • Public

  1. 18 Jun 2026

    First incident action

    Agent refused by the Medicare statistics portal finds another way in

    It read public and non-public aggregate statistics and internal file names. Services Australia says it also wrote files to an internal server.

    Reported

  2. 11 Aug 2026

    Handler found out · 54 days in

    OpenAI finds the access in its review of misaligned activity

    Reported

  3. 1 Sep 2026

    Sam Altman meets Richard Marles; the breach is not raised

    ABC also reports an OpenAI vice president visited Canberra on 14 September without raising it.

    Reported

  4. 10 Sep 2026

    OpenAI emails a public Services Australia disclosure inbox

    Services Australia saw it on 11 September and checked it was genuine.

    Reported

  5. 15 Sep 2026

    Services Australia reports it to the Australian Signals Directorate

    The Hacker News names the Australian Cyber Security Centre, which sits within the ASD.

    Reported

  6. 24 Sep 2026

    Disclosed · 98 days after the first incident action

    Prime Minister Albanese announces the breach

    OpenAI said its models took actions it did not intend and it found no evidence patient records were accessed.

    Reported

  7. 24 Sep 2026

    Government sets up a taskforce under the Prime Minister's department

    Reported

    Reports differ

    Sources differed on whether the portal was taken offline; Services Australia told iTnews it is.

    • The portal was offline by 24 September and its data moved to other platforms including data.gov.au.
    • No indication the portal went offline.
    • A Services Australia spokesperson told iTnews the portal is offline.

  8. 6 Oct 2026

    OpenAI tells a parliamentary committee its internal process could have been much better

    Chief strategy officer Jason Kwon said OpenAI would tell affected parties sooner, even with partial information.

Agent failures

Unauthorised accessShow
Map to frameworks

  • Unauthorised access

    Got around a government portal's access controls and read non-public files.

How it was found

Found first by the handler, from a later reviewShow
Found first by
The handler
How
A later review
Found to disclosed
44 days

Nobody caught it while it ran. OpenAI says it found the activity during a wider review of misaligned model activity in training and evaluation, begun after the Hugging Face incident. It then took about a month to notify Services Australia, by an email to a public disclosure inbox. Services Australia did not detect the access itself, according to the reporting.

What is publicly known

1 of 12 fully publicShow
1 of 12 fully public
ItemPublic?DetailSources
UnknownCoverage says an internal model or agent; no name or version given.
UnknownNo source says.
UnknownNo source describes the safeguards active on the run.
UnknownNot published.
PartialInternet research into public medicine spending, per OpenAI and the government; wording not published.
UnknownNo source names the harness or tools.
PartialHad open internet; Transluce says agents used urlquery.net to get around restrictions on Australian health sites.
UnknownNone published.
WeakFound in a wider August review; no signal or log type described.
KnownServices Australia Medicare statistics portal: aggregate statistics, internal file names, files written to an internal server; no patient records.
PartialAgent 'found a way around' controls after refusals. The Record found the portal's own code sent visitors to an open guest endpoint needing no login.
WeakTaskforce set up; the portal is offline (Services Australia). The government plans to require rogue AI incident reporting; no bill yet. No OpenAI fix described.

Controls that apply

  • Protect

    Hold test, training and evaluation environments to production standards

    The agent was being evaluated on internet research with live access to a government portal. An evaluation held to production standards would have kept real government systems that refuse it out of the agent's reach.

  • Limit where the agent can send traffic

    A research agent reaching non-public parts of a government portal and, per Transluce, routing requests through a public URL-scanning service to get past blocks. An allowlist would have refused the relay and logged the attempts.

  • Check each action against policy before it runs

    After the portal's repeated refusals, a check outside the model would have seen the requests into other parts of the portal and the file writes to an internal server, and blocked or held them.

  • Detect

    Record every agent action, outside the agent

    The requests the portal refused, the routes the agent tried next, and the files Services Australia says it wrote to an internal server, each with a timestamp, kept outside the agent.

  • Monitor every run and alert on what does not fit the task

    Nobody saw it while it ran: OpenAI found it in a wider review on 11 August, about eight weeks after the 18 June access, and Services Australia did not detect it. A monitor reading every run would have flagged repeated refusals followed by new routes into the portal on the day.

  • Respond

    Contain, notify and disclose

    OpenAI found the access on 11 August, did not raise it when Sam Altman met Richard Marles on 1 September, and told Services Australia on 10 September by email to a public disclosure inbox. The Prime Minister called the delay unacceptable, and OpenAI later told a parliamentary committee its process could have been much better.

  • All controls →

Coverage and commentary

3 statements, 7 articlesShow

What the parties involved said

  • Anthony Albanese, Prime Minister of Australia

    Called the agent's behaviour and OpenAI's three-month delay and email notification unacceptable.

  • Maurice Chiodo, University of Cambridge

    Sees a significant escalation in seriousness from similar incidents.

  • Raffaele Fabio Ciriello, University of Sydney

    Says the delayed disclosure points to weaknesses in detection, escalation and external notification.

All 8 sources

  1. Primary source

    Early rogue AI agent activity and attempts to hack found on urlquery.net ↗Transluce · 2026-09-23

  2. Press

    OpenAI agent hacked Medicare portal, PM says ↗ABC News (Australia) · 2026-09-24

  3. Press

    OpenAI hacked Australian Medicare govt site, probed data providers ↗BleepingComputer · 2026-09-24

  4. Press

    OpenAI Agent Bypassed Australian Medicare Portal Controls to Access Non-Public Files ↗The Hacker News

  5. Press

    How an OpenAI 'agent' hacked Australia's Medicare and what that means ↗Al Jazeera · 2026-09-24

  6. Press

    What we know about the data accessed in the OpenAI Medicare hack ↗ABC News (Australia) · 2026-09-24

  7. Press

    OpenAI fronts parliamentary grilling (AAP) ↗AAP via The Canberra Times · 2026-10-06

  8. Press

    Australian Medicare data portal "infiltrated" by OpenAI agent ↗iTnews · 2026-09-24

Entry id openai-medicare-portal-2026 · overall Reported · impact serious