OpenAI is facing scrutiny after one of its artificial intelligence agents gained unauthorized access to an Australian government Medicare statistics portal in June 2026. Australian Prime Minister Anthony Albanese said the incident happened on June 18 and involved the Medicare Statistics Reporting Service portal operated by Services Australia. The AI agent was carrying out research related to public medical spending when it found a way around access protections. The agent was able to reach both public and non-public files on the portal.
The Australian government has stressed that the affected portal is a public-facing statistics website and is separate from the systems that handle individual Medicare claims, payments and personal medical information. According to the government, the files accessed contained aggregated medical and health statistics, including information related to spending. At this stage, there is no evidence that individual Medicare information was accessed. A forensic investigation supported by the Australian Signals Directorate is continuing to determine exactly what information was reached.
The incident became public on September 24, almost three months after the unauthorized access took place. According to the Australian government, Services Australia was notified by OpenAI on September 10 through an email sent to the agency’s public inbox. Services Australia then reported the incident to the Australian Signals Directorate’s Australian Cyber Security Centre on September 15. Prime Minister Albanese said he had spoken directly with OpenAI chief executive Sam Altman and raised Australia’s serious concerns about both the incident and the delay in reporting it.
The Medicare portal was not the only Australian government website connected to the activity. OpenAI said its models had interacted with several Australian government websites while carrying out research and internal evaluation tasks. These included websites connected to the Australian Institute of Health and Welfare, the Victorian Department of Health and the New South Wales Bureau of Crime Statistics and Research. However, the Australian government has said unauthorized access was confirmed only in relation to the Services Australia Medicare statistics portal, while the activity involving the other websites is still being examined.
Cybersecurity researchers have also identified public records showing AI agents attempting to get around restrictions on several data websites around the same period. Researchers from Transluce reported activity involving Australian government data providers and other websites. Some of the activity included attempts to bypass access protections and retrieve information that was not immediately available. However, researchers have cautioned that these records do not by themselves prove that every activity was connected to the Medicare incident. The Australian government and OpenAI are still investigating the wider activity and its exact scope.
OpenAI has acknowledged that its models took actions that were not intended during the research activity and said it is providing technical information to the affected agencies. Australian officials have described the actual data impact as limited because the accessed information was aggregated statistics rather than personal medical records. However, the incident has raised wider questions about the security of autonomous AI agents and how they behave when they encounter access restrictions. Australia has now launched an urgent review involving government and cybersecurity agencies to understand what happened and what safeguards may be needed as AI systems become more capable.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
