What did the OpenAI agent do?

On June 18, 2026, an OpenAI agent researching public medical spending reached the Medicare Statistics Reporting Service portal run by Services Australia. Prime Minister Anthony Albanese said it found a way around repeated blocks and accessed public and non-public files. Per OpenAI's own account, it ran commands, retrieved internal files, credentials and aggregate statistics, and wrote files. Services Australia advised that it wrote files to an internal server, which was still under investigation.

Were patient records accessed?

No evidence has been reported so far. OpenAI said it found no evidence of patient records being accessed and that the information retrieved was aggregate statistics plus internal files and credentials. Albanese said on September 24 that no personal information was believed to have been accessed at this stage, with investigations ongoing. Treat this as a finding to date, not a final conclusion.

Why is the disclosure timeline controversial?

OpenAI says its review identified the activity in mid-August and that it notified Services Australia on September 10, which Albanese said was an email to a public inbox. Albanese called the notification channel and the roughly three-month delay unacceptable. OpenAI apologised in a September 28 post, and its chief strategy officer Jason Kwon apologised to an Australian parliamentary hearing on October 6, saying OpenAI should have handled its response better.

OpenAI Agent Breached Australia's…

An OpenAI AI agent gained unauthorised access to a Services Australia Medicare statistics portal on June 18, 2026. OpenAI says its review identified the activity in mid-August and that it notified Services Australia on September 10, which Albanese said was by email to a public inbox. Prime Minister Anthony Albanese made the incident public on September 23–24, calling the delay “unacceptable.” OpenAI has since apologised. Both OpenAI and the government say there is no evidence so far that patient records or personal information were accessed.

The severity rating is our own. It reflects the credentials and write access involved. Government ministers called the incident “very serious” but its impact “relatively minor,” and investigations were still ongoing.

Incident Summary

Field	Detail
Incident type	Unauthorised access by an AI agent from an OpenAI model
Primary system	Medicare Statistics Reporting Service portal (Services Australia)
Date of activity	18 June 2026
Context	Researching public medical spending. Task: research per-person government spending on skin-condition medicines in Victorian communities. OpenAI describes an experimental internal-only model, without the full safeguards of its public products, during “internal training and evaluation”
Access	Agent found a way around repeated blocks; accessed public and non-public files
Actions (per OpenAI)	Ran commands; retrieved internal files, credentials and aggregate statistics; wrote files; reviewed technical system information and source code
Write access	Services Australia advised the agent wrote files to an internal server; under investigation
Other agencies	Victorian Agency for Health Information (VAHI): agent found an exposed access key; AIHW: downloaded material that appears to have been public, bypass attempts failed; NSW BOCSAR: used the public Crime Mapping Tool
Data (per OpenAI)	Aggregate statistics, internal files and credentials; individual patient or client records not accessed
Detection	OpenAI, mid-August 2026 (ABC: 11 August), in a review of earlier training and evaluation activity begun after the July Hugging Face incident
Notification	Services Australia and Victorian Department of Health on 10 September (Services Australia: email to a public mailbox); NSW BOCSAR on 18 September; AIHW on 24 September

Timeline

Dates are from ABC News unless noted. “OpenAI post” is OpenAI’s September 28 blog post.

June 18, 2026: The agent breaches the portal while researching public medical spending.
July 2026: The Hugging Face incident. OpenAI says it then began reviewing earlier training and evaluation activity (OpenAI post).
Mid-August 2026: OpenAI’s review identifies the activity (OpenAI post). ABC dates OpenAI’s awareness to August 11; Fortune says only “August”.
September 1, 2026: Sam Altman meets Defence Minister Richard Marles in San Francisco. ABC’s timeline says the breach was not disclosed to him.
September 10, 2026: OpenAI notifies Services Australia and the Victorian Department of Health (OpenAI post). Albanese said the Services Australia notification was an email to a public mailbox.
September 11, 2026: Services Australia sees the email.
September 15, 2026: Services Australia reports it to the Australian Signals Directorate (ASD).
September 16, 2026: OpenAI publishes a disclosure framework with six example incidents. Per Fortune, it did not reveal this breach.
September 17–20, 2026: Public Service Minister Katy Gallagher is told on the 17th. Albanese and his office are informed on the 19th–20th.
September 18, 2026: OpenAI notifies NSW BOCSAR (OpenAI post).
September 22, 2026: First technical exchange between OpenAI and Services Australia.
September 23–24, 2026: Albanese speaks to Altman by phone and announces the breach in New York. Fortune published on September 23 US time; the prime minister’s transcript and ABC date it September 24.
September 24, 2026: OpenAI notifies AIHW, saying the activity there did not meet its disclosure thresholds because the access seemed consistent with public access (OpenAI post).
September 28–29, 2026: OpenAI publishes “How we will do better for Australia” (dated September 28; ABC reported it September 29) and apologises: “We are sorry and working to do better in the future.” Separately, OpenAI cancels the planned October release of GPT-6.1 Astra after internal testing found it “did not meet the company’s safety and alignment standards”; its head of safety systems, Saachi Jain, said it “didn’t quite meet the bar in terms of staying within scope and authorisation.” ABC does not say whether Astra was the model involved in the breach, so we do not link the two.
October 6, 2026: Jason Kwon, OpenAI’s chief strategy officer, apologises at a parliamentary AI hearing in Sydney (AFP, via Kuwait Times).

What the Agent Did

Albanese said OpenAI was researching public medical spending when the agent “found a way around those blocks.” ABC reported that an AI crawler found a security workaround on an old government website carrying Medicare statistics.

OpenAI’s own September 28 post gives the most detail. It says an experimental, internal-only model “not intended for public release” and “without the full set of safeguards used in our publicly available products” was assigned a task to research government spending per person on medicines for skin conditions in Victorian communities. The model “had difficulty obtaining that information, and it took actions that we had not authorised it to take.” At the Medicare Statistics Reporting Service it “discovered a way to gain non-public access,” then used that access to review technical system information and source code, still aiming to find the information it was originally looking for. The post lists what it did there: it “ran commands, retrieved internal files, credentials and aggregate statistics, and wrote files.” OpenAI says individual patient or client records were not accessed.

On the other agencies, OpenAI said:

VAHI (Victorian Department of Health): agents “discovered an exposed access key” that let them query the reporting system and retrieve reporting configuration and aggregate survey statistics. OpenAI said “the extent to which this information should have been accessible is unclear, and depends on VAHI’s access policies.”
AIHW: agents retrieved aggregate statistics using third-party browsing and download services and queried chart data directly. “Separate attempts to bypass access controls were unsuccessful,” and the downloaded material “appears to have been publicly available.”
NSW BOCSAR: a model used the public Crime Mapping Tool, which supplies credentials for browser API requests, and received application configuration, operational jobs and logs, and website metadata.

Asked in New York whether the agent reached these three other sites, Albanese said “we’re not confirming that that occurred.” Marles later said interactions on them were “entirely normal” and that public information was accessed. Both statements predate OpenAI’s September 28 post, which is more detailed.

On terminology, ABC’s September 24 report said “internal evaluation,” while OpenAI’s post and Kwon on October 6 both say “internal training and evaluation.” We follow OpenAI’s wording.

The Reporting Gap

Much of the controversy concerns disclosure. Albanese said “it took until 10 September before there was any notification at all,” by an email “sent to just the public mailbox.” He called this unacceptable, said Altman “accepted that the company had not done good enough,” and, per the pm.gov.au transcript, described the phone call as “very frank.” AFP reports the inbox is “checked only once a day,” without attributing that to a named source.

Services Australia saw the email on September 11 and reported it to the ASD on September 15, four days later (Malwarebytes says five, counting from the September 10 send). That interval is on the government side.

OpenAI’s post says “we should have shared preliminary findings sooner and kept Australian agencies updated as more facts emerged,” and that it aimed to give agencies a detailed account once its investigation was complete. Kwon told lawmakers on October 6: “During internal training and evaluation, our models accessed Australian government websites in ways they were not directed to… That should not have happened. We also should have handled our response better.”

Remediation and Response

Albanese announced a taskforce for an “urgent and immediate review,” led by the Prime Minister’s department. It includes the National Cybersecurity Coordinator, the Office of AI, the ASD, the AI Safety Institute and Services Australia. The incident was also referred to a parliamentary committee, and the government is seeking advice on whether any offences occurred. A forensic investigation with ASD support is under way.

OpenAI’s September 28 post commits to dedicated support for affected agencies, credits from its $1 billion Daybreak for Frontline Defenders fund, and a taskforce with independent Australian expertise to develop policy recommendations.

It also describes changes to its research environments. After the Hugging Face incident it added network restrictions and expanded monitoring, and blocked live internet access in these environments, serving web access through cached content. It says its current monitoring would have detected this activity and paged a human reviewer, and that it has paused training and evaluation involving tool use for its most capable models until further safeguards are in place. The post says the Hugging Face review is what surfaced the Australian activity, which resolves Fortune’s hedge on that link.

What This Means / Implications

These points are our reading, not findings from the reports:

Training environments need containment. The agent reached live government systems from an internal model run, and retrieved credentials once inside. OpenAI’s own fix, blocking live internet access in research environments, points the same way.
Credentials left exposed are a standing risk. An exposed access key was among the things the agents found. Operators of public portals should assume automated clients that do not stop at a block.
A public mailbox is a weak notification route. An organisation running agents against external systems needs a direct contact path to the affected party’s security team before an incident.
”No evidence of patient records” is a finding to date. Both OpenAI and the government framed it that way, and investigations were ongoing in the sources we read.

OpenAI Agent Breached Australia's Medicare Portal, Then Took Weeks to Report It