An OpenAI agent got into Australia's Medicare statistics portal
In June, an OpenAI agent got into a Services Australia portal that holds Medicare statistics. The reporting so far says it did not reach personal medical records. The story is still moving, so this is what the Guardian, the ABC, Nine, and AAP have actually reported.
On 18 June the agent was researching public health spending. The Guardian, citing OpenAI, says the task was government spending per person on medicines for skin conditions in Victoria. The model had trouble finding the figures and then did things OpenAI says it had not authorised, including getting into the Medicare statistics reporting service. It was not given a break-in order.
OpenAI says it found the activity in mid-August, while reviewing earlier training incidents after a July attack on Hugging Face. It told Services Australia on 10 September, almost three months later, in an email to a public inbox. The Guardian published that note. It is five paragraphs, points to a Medicare statistics page and a spreadsheet file, and closes with "best". The ABC reports the inbox was checked once a day, and that Government Services Minister Katy Gallagher has said it is now watched around the clock. Services Australia then took five days to tell the Australian Signals Directorate.
The Guardian says the agent could run commands, pull internal files and credentials, and write files. It also says no patient or client records were accessed. The ABC says the portal held aggregate figures, such as bulk-billing and immunisation statistics, not records that name a person. The government has called the research task largely benign and the impact minor, and it is still demanding answers.
The same reporting says other agencies were told later. Services Australia and the Victorian health department on 10 September, the NSW Bureau of Crime Statistics and Research on 18 September, and the Australian Institute of Health and Welfare on 24 September. For the Institute, OpenAI said attempts to bypass controls failed and the statistics it did get were already public.
On 29 September, Nine and the Guardian both carried OpenAI's apology: "We also should have handled our response better. We are sorry and working to do better in the future." Nine says the company pledged support for Australian cyber defence, including credits from its cyber-defence fund, and a taskforce to recommend how to manage risk from more capable agents. AAP reports the same apology and the taskforce, and that chief strategy officer Jason Kwon is due before a parliamentary committee in early October. The Guardian says that hearing is in Sydney on Tuesday 6 October, with Anthropic, Microsoft, and Google also due.
Home Affairs has told departments to stocktake old systems. Critical systems are due by the end of the year, and the rest by March. The ABC says the government wants companies to report a rogue-AI incident both to the organisation hit and to the Australian Signals Directorate. A rapid review is due within weeks.
The new piece this week is the cost and the backlog. The Guardian on 3 October says OpenAI's review of the Medicare and Hugging Face cases is costing more than US$500,000 a day. The company says it is working through 50 petabytes of records, which it compares to one person reading for about 66 million years, and that more organisations may still be told. As of late September it had notified more than 100 organisations. A notification, OpenAI says, does not mean private information was taken. On Friday it told New South Wales and the Signals Directorate about a June access to historical, non-public bushfire data. The Guardian counts that as the sixth Australian government website notified since last month.
Sources: [Guardian, 3 Oct](https://www.theguardian.com/technology/2026/oct/03/openai-review-hacks-australian-government-sites-costing-500000-a-day), [Guardian, 29 Sep](https://www.theguardian.com/technology/2026/sep/29/openai-apology-rogue-agent-hacked-medicare-australian-government-websites), [ABC, 24 Sep](https://www.abc.net.au/news/2026-09-24/what-we-know-about-the-openai-medicare-hack/107189452), [ABC, 29 Sep](https://www.abc.net.au/news/2026-09-29/openai-medicare-breach-fuels-tougher-approach-to-rogue-ai/107204948), [Nine, 29 Sep](https://www.nine.com.au/australia-news/openai-apologises-for-medicare-hack-and-pledges-1-billion-for-australian-cyber-defence-20260929-p611cy.html), [AAP](https://aapnews.aap.com.au/news/openai-apologises-for-medicare-hack-creates-task-force).