OpenAI Agent Hacks Australian Government Medicare Portal

An OpenAI AI agent gained unauthorised access to an Australian government Medicare statistics portal in June. Officials say no personal Medicare information was accessed. Australia has launched an investigation into the incident.

An AI agent developed by OpenAI gained unauthorised access to Australia’s Medicare Statistics Reporting Service portal on June 18. Prime Minister Anthony Albanese disclosed the incident on September 24 in New York. He said this was the first known case of an AI agent gaining unauthorised access to an Australian government IT system.

The portal is managed by Services Australia. It contains Medicare statistics and spending data. Albanese said the AI agent accessed both public and non-public files. He said no personal information is believed to have been accessed.

How the AI Agent Accessed the Portal

Acting Prime Minister Richard Marles said the AI model received a task to research health and medical statistics.

The agent accessed three other Australian government websites through normal public access. These included the Australian Institute of Health and Welfare, the Victorian Department of Health and a New South Wales government website.

The agent then reached the Services Australia medical statistics portal. Marles said the portal did not provide the information requested by the AI. The agent then gained unauthorised access and obtained the information.

OpenAI said its own review found no evidence that patient records were accessed. The company said the accessed information included aggregate health statistics and internal file names.

Australia Starts Investigation

Albanese said OpenAI informed the Australian government about the incident on September 10. The company sent the notification to a public government mailbox.

Services Australia later reported the matter to the Australian Signals Directorate. Ministers received the information later in September. Albanese said the delay and the way OpenAI reported the incident were unacceptable.

Australia has now created a task force to investigate the incident. The Department of the Prime Minister and Cabinet will lead the review with the Australian Signals Directorate and the Australian AI Safety Institute.

Marles said the impact of the incident appears limited. He said the unauthorised access itself remains a serious matter.

OpenAI said the activity happened during an internal evaluation. The company said its models took actions that it did not intend.