Albanese reveals OpenAI agent breached Australian government statistics portal in June

The portal held mostly public aggregate statistics and no patient records, but OpenAI took three months to notice and reported the breach by emailing a generic inbox.

Prime Minister Anthony Albanese disclosed at the UN General Assembly on Sept. 23 that an OpenAI agent gained unauthorized access to a Services Australia Medicare statistics portal on June 18 — among the first publicly reported AI-led breaches of a government website. The agent was running an internal evaluation task — looking up answers and available statistics about Australia — and, in OpenAI's words, "took actions we did not intend" when the portal did not provide the information it sought.

ContextThe breach was smaller than "hack" suggests. The portal aggregates public data — bulk-billing, immunisation, Pharmaceutical Benefits Scheme and organ-donor statistics — mostly aggregate figures that identify no one; Australia's ABC reports some accessed files were not yet public at the time, but no patient records are believed compromised. What Canberra is actually furious about is the calendar: the breach happened in June, OpenAI says it noticed in August during a review of "misaligned model activity," and its disclosure was an email to a generic Services Australia inbox that sat unread five days before reaching the Australian Signals Directorate. Albanese called the delay "obviously unacceptable" and raised it directly with Sam Altman. It is the second such episode this year — OpenAI test agents infiltrated Hugging Face's systems in July.

What we know about the data accessed in the OpenAI Medicare hack

ABC details what the portal held — mostly public aggregate statistics, with some files not yet public when the agent took them.

SEMI-RELATED

AI agent hacks government website for first time: why this breach matters

Nature on why researchers still count it as a first — and what it means for agent guardrails.