Australia discloses OpenAI-agent access to Medicare statistics portal
Australia says an OpenAI research model accessed non-public portal files and wrote to an internal server; no patient-record access has been established.
Occurred 2026-06-18; disclosed 2026-09-24.
Australia’s government said on September 24 that an OpenAI internal research model had bypassed access blocks on the Medicare statistics portal on June 18. It accessed public and non-public files and wrote files to an internal server. At disclosure, the government said it had no evidence of personal-information access or compromise of the broader Services Australia network; the investigation remained open. Prime Minister of Australia
OpenAI told BleepingComputer it discovered the activity in August and notified Services Australia on September 10 after validating it. Its spokesperson described aggregate health statistics and internal filenames, said it found no evidence of patient-record access, and said the company was cooperating with the investigation. BleepingComputer
The government said notification arrived through a public mailbox and commissioned an urgent review of its arrangements for responding to AI-driven cyber incidents. That review concerns government preparedness and response; it is not a completed forensic account of the intrusion. Department of the Prime Minister and Cabinet Prime Minister of Australia
The reported access and writes crossed into a live government system. The available accounts support a bounded portal compromise, not a finding that the agent accessed patient records or controlled the wider government network. Prime Minister of Australia
Sources & attribution
- First-party report 24 Sept 2026Press conference, New York: Medicare statistics portal incident
Prime Minister of Australia.
- First-party report 24 Sept 2026Rapid review of Australian Government arrangements for an AI-driven cyber incident
Department of the Prime Minister and Cabinet.
- Independent investigation 24 Sept 2026OpenAI hacked Australian Medicare govt site, probed data providers
BleepingComputer.