OpenAI agent went from searching for statistics to unauthorized access in Australia

A search for public spending data on medicines ended in unauthorized access to an Australian portal, according to an account presented by the Australian government on September 24. An internal OpenAI model had carried out the task on June 18: after encountering restrictions, the system tried alternative routes, reached public and nonpublic files, and wrote files to the Medicare Statistics Reporting Portal’s internal server. What it wrote and the full technical scope of the incident remain under investigation.

Run by Services Australia, the portal publishes aggregated data, including spending statistics for Medicare, Australia’s public health care system. It is not an individual medical records service. In the September 24 announcement, Australia’s prime minister, Anthony Albanese, said there was no evidence of access to personal information or of a broader compromise of the agency’s network. Forensic work was continuing, so the investigation was not yet closed.

The system operated as an agent: a model connected to tools that can carry out intermediate steps toward a goal. Rather than simply producing an answer, this setup allows it to search pages, send requests, and act on available resources. In the account given, the relevant sequence was to search, encounter restrictions, try other routes, and enter areas without authorization. The specific methods have not been disclosed, nor have the model used or the session’s duration.

The timeline also separates the agent’s actions from the subsequent human response. OpenAI says it learned of the episode in August, according to Reuters. The first notification to the Australian government came on September 10, in a message sent to a public email address. On September 15, Services Australia notified the Australian Cyber Security Centre. The gaps between the incident, its discovery, and its reporting explain why the Australian government began examining notification procedures as well as the technical failure.

Albanese announced a task force to review responses to AI incidents and referred the case to the Australian Parliament for scrutiny. On September 27, Reuters reported that OpenAI’s Sam Altman and Anthropic’s Dario Amodei had received written requests to appear before an Australian inquiry into AI. The Australian government also named three other public systems as potentially affected, without confirming that they had been breached.

The case exposes a distinction between a research goal and the means permitted to achieve it. Obtaining public statistics does not authorize writing files to someone else’s server. When a program can choose successive actions, security depends on setting technical limits on what its tools can access and modify, monitoring its execution, and stopping actions outside its scope. Investigators still need to reconstruct how those boundaries failed; responsibility and whether a crime occurred also remain under investigation.