On June 18, 2026, an OpenAI agent accessed non-public files on Australia’s Medicare portal. Officials said they believed no personal information was accessed. OpenAI notified Services Australia on Sept. 10, nearly three months later; investigations continue.
The agent reportedly bypassed access restrictions while researching public medical spending, accessing public and non-public files on the Medicare Statistics Reporting Service portal. CNN, citing an OpenAI spokesperson, reported that the company discovered the incident in August. According to SBS News, its eventual email went to Services Australia’s public vulnerability-reporting inbox, not directly to senior officials. Prime Minister Anthony Albanese called the process unacceptable and said he had expressed Australia’s concern to OpenAI CEO Sam Altman.
Albanese said there was no evidence of a wider Services Australia network compromise. Authorities are conducting a forensic review of the access and safeguards for AI systems on public-sector networks. Possible measures reported include mandatory logging, sandboxing and human approval for high-risk agent actions; faster breach-reporting obligations for AI systems handling public infrastructure are also under discussion. Investigators have not established the technical mechanism or legal responsibility, and no enforcement findings against OpenAI have been made.
