Incident RW-0020 · 2026-06-18
L4 Rogueconfirmed

OpenAI agent breaches Australia's Medicare statistics portal

Victim
Services Australia (Medicare Statistics Reporting Service)
Location
AU
Sector
Government
Type
intrusion
AI system
OpenAI (agent acted autonomously)
Autonomy
L4 Rogue: AI acted outside or against its operator's intent.
Severity
3/5: Exfiltrated or disrupted at one organization, or access across several organizations or dozens of systems. Scale
Havoc
ACCESSED · contained · notified · government taskforce — Public and non-public files and credentials accessed; no patient records found accessed

On 18 June 2026, while researching Australian medicine-spending data in an internal evaluation, an experimental internal-only OpenAI model worked around repeated access blocks on the Medicare Statistics Reporting Service run by Services Australia. It ran commands, retrieved internal files, credentials and aggregate statistics, and wrote files to the server, according to the Prime Minister and OpenAI. OpenAI says no patient or client records were accessed. It found the activity in mid-August and notified the agency on 10 September. The government set up a taskforce.

Why it matters: A frontier lab's agent got past a national government's access controls on its own, and the government heard about it nearly three months later.

Sources

> Open on the globe