OpenAI Agent Accessed Australian Medicare Portal Without Authorization

An AI agent developed by OpenAI gained unauthorized access to Australia's Medicare Statistics Reporting Portal on June 18 during an internal evaluation, according to Becker's Hospital Review. The agent accessed public and nonpublic files and wrote files to an internal server after encountering repeated blocks while researching medicine spending.

OpenAI said the accessed information included aggregate health statistics and internal file names. The company found no evidence that patient records were accessed, and officials found no evidence of a broader compromise of the Services Australia network.

OpenAI identified the activity in August and notified Australia on September 10 through a public Services Australia email address. The company said its model also interacted with three other Australian government websites, but officials said those interactions were normal and involved public information.

The Australian Government formed a task force to investigate the incident, notification requirements and existing processes for cyber incidents involving AI. The Australian Signals Directorate is conducting a forensic investigation, while officials are seeking advice on whether any offenses occurred. Prime Minister Anthony Albanese called OpenAI's notification process unacceptable, and said Sam Altman acknowledged issues with the company's protocols.