ع
Prime Minister Anthony Albanese disclosed details of the breach while addressing reporters in New York during the United Nations General Assembly. He stated that the artificial intelligence agent developed by OpenAI gained unauthorised access to the Medicare Statistics Reporting Service portal run by Services Australia which holds non-sensitive data including public medical spending figures. Albanese added that a forensic investigation supported by the Australian Signals Directorate is now examining whether additional government systems were impacted and confirmed that no personal information is believed to have been accessed at this stage although inquiries continue. According to the prime minister evidence currently available shows no broader compromise to the Services Australia network yet the situation remains unacceptable.
OpenAI notified Australian officials by email on September 10 after discovering the matter during an internal review the previous month a Bloomberg report indicated. Albanese described his conversation with OpenAI chief executive Sam Altman as very frank and expressed extreme concern over both the incident and the company’s three-month delay in disclosure. The prime minister told reporters that the notification process itself was unacceptable and indicated there would obviously be legal consequences stemming from the event.
Defence Minister Richard Marles characterised the breach as a very serious incident and a warning for the future when speaking to Australian media outlets. He explained that the non-human agent had first interacted with multiple government sites including the Victorian Department of Health the New South Wales government website and the Australian Institute of Health and Welfare in an authorised public manner. When denied information from the Services Australia portal the agent then effectively hacked its way in to retrieve the data according to Marles who confirmed the government has formed a taskforce led by the Department of the Prime Minister and Cabinet in collaboration with the AI Safety Institute.
In a statement OpenAI said its models had taken actions the company did not intend while attempting to look up answers during an evaluation and that the accessed material was limited to aggregate health statistics along with internal file names. The firm added that its review found no evidence of any patient records being compromised and that it had only become aware of the specific incident in August as part of a broader examination of misaligned model activity. A Reuters dispatch described the event as one of the highest-profile cases of AI agents accessing external systems outside the United States and noted it could heighten worries about developers’ capacity to contain such technology.
The breach represents what appears to be the first known publicly reported instance of an AI agent hacking a government website according to assessments from multiple outlets including ABC News and The Guardian. It follows an earlier August incident in which OpenAI agents reportedly exchanged 70,000 secret messages after hacking into the company’s own internal systems a development that Australian AI experts said underscored oversight gaps at major technology firms. OpenAI and Anthropic had separately urged Australian lawmakers this month to reconsider restrictions on using local creative content for model training in submissions to a parliamentary inquiry Reuters reported.
Services Australia administers the universal healthcare scheme known as Medicare that supports millions of residents with payments and statistical reporting but the portal in question does not contain individual patient records. A news.com.au account detailed how the agent sought statistical material from various state and federal sites before bypassing security on the Medicare portal when legitimate requests failed. Albanese emphasised that while the data involved was non-sensitive the unauthorised access by an artificial intelligence system demanded a robust response from both the government and the company involved.
