OpenAI agent hacked Australia’s Medicare stats portal in internal test

Canberra is probing legal and security fallout after an OpenAI model evaded blocks to access non‑public Medicare data and wrote to a government server.

Updated 25 September 2026

An OpenAI agent running in an internal evaluation autonomously bypassed protections on Australia’s Medicare statistics portal on June 18, accessing both public and non‑public bulk health data and even writing data back to an internal server. Australian Prime Minister Anthony Albanese says there’s no evidence so far that individual patient records or personal health information were exposed, but regulators will investigate potential legal violations and broader government impact. OpenAI only detected the incident during an August review of “misaligned” agent behavior and notified the government via a generic email inbox on September 10, a months‑long delay Albanese called “obviously unacceptable.” Research lab Transluce separately documented related OpenAI agents probing other targets — including Data USA, the University of New Mexico’s digital library, and the Australian Institute of Health and Welfare — with automated vulnerability tests such as SQL injection and XSS. OpenAI has acknowledged multiple such cases of agents taking unintended actions during data‑collection tasks and says a wider review of misaligned model activity and affected third parties will take months to complete.