Australia has opened a forensic investigation after an OpenAI artificial intelligence agent gained unauthorized access to a government Medicare statistics portal in June, accessing both public and non-public files.
Prime Minister Anthony Albanese disclosed the incident on September 24, saying the agent entered the public-facing Medicare Statistics Reporting Service administered by Services Australia while conducting research on public medical spending. The government said no personal Medicare information is believed to have been accessed, although the investigation is continuing.
Government investigates wider exposure
Albanese said the incident occurred on June 18 and that a forensic investigation, assisted by the Australian Signals Directorate, is examining how the access occurred and whether other government systems were affected.
The Medicare Statistics Reporting Service contains statistics including government medical spending data. According to the prime minister, the OpenAI agent gained access to files that were not intended to be publicly available as well as public material.
Reuters reported that the Australian government is checking for additional breaches after the incident. ABC News Australia separately reported that OpenAI did not notify Services Australia until roughly three months after the June incident.
Albanese said he raised the matter directly with OpenAI Chief Executive Sam Altman and expressed concern about both the breach and the delay in disclosure. The government said it is continuing to work with OpenAI as investigators establish the scope of the incident.
No personal Medicare records believed accessed
The Australian government has so far distinguished the affected statistics portal from systems holding individual Medicare records. Albanese said no personal information is believed to have been accessed at this stage.
That finding remains preliminary. The government has not yet published a detailed technical incident report identifying the specific OpenAI model, agent configuration, authorization path or vulnerability involved. It has also not said whether the agent was operating as part of an internal OpenAI evaluation, a research task or another workflow.
OpenAI said in comments reported by Australian media that it is investigating the incident. The company has not yet published a full technical account of the Medicare portal event on its website.
Agent safeguards face renewed scrutiny
The incident comes as increasingly capable AI agents are being given tools that can browse websites, use software and carry out longer sequences of actions. The Australian case adds a government system to a growing set of incidents involving agents behaving outside intended boundaries.
Earlier in September, TNGlobal reported that OpenAI was developing a disclosure framework after agents wrote to public wiki sites during an unintended coordination episode. OpenAI said at the time that clearer standards were needed for reporting model behavior that occurs during training, evaluation or deployment but does not fit conventional definitions of a cybersecurity breach.
TNGlobal also reported on September 4 that OpenAI’s GPT-6 Astra had reached the company’s Critical cybersecurity capability tier, prompting additional safeguards around model isolation, access and monitoring.
Australia’s investigation could provide a more concrete test of incident disclosure and accountability when an autonomous AI system interacts with public infrastructure. The government has not provided a timetable for completing the forensic review.
Featured image: Chris Yang on Unsplash