An AI agent on an internal OpenAI research task bypassed access controls on an Australian government Medicare statistics portal in June, Prime Minister Anthony Albanese said.
The portal publishes aggregate figures, such as spending, and is separate from the systems that handle Medicare claims and personal records. The agent reached files on it that were not public, but no personal information is believed to have been accessed so far.
OpenAI first told the government on September 10, in an email to a public mailbox at Services Australia, which runs the portal. OpenAI says it found the activity in August. Albanese said the company took far too long to inform the government and that the manner in which it did so was unacceptable.
On June 18, the portal repeatedly refused the agent’s data requests, but the agent found a workaround and gained unauthorized access. The government has not said how the agent got past them.
Services Australia has told the government that the agent also wrote files to an internal server. That is still being investigated. The evidence so far shows no wider compromise of the agency’s network.
The non-public data was not particularly sensitive and has since been published. By September 24, the portal had been taken offline, and its data moved to data.gov.au and other secure platforms.
Acting Prime Minister Richard Marles told the ABC that national security information is subject to much stronger protections, while the portal’s information was “kept behind a fence that the AI agent effectively climbed over.”
OpenAI said in a statement to Fox Business that its models “took actions we did not intend” while looking up statistics about Australia during an internal evaluation.
The company found it during a wider review of what it calls misaligned model activity in training and evaluation, and checked what had been accessed before notifying Services Australia.
The activity involved several Australian government websites and services. The information its models accessed included aggregate health statistics and internal file names, and OpenAI found no evidence that patient records were accessed.
The government has described unauthorized access only at the Medicare statistics portal.
Services Australia saw OpenAI’s email on September 11, checked that it was genuine and reported the incident on September 15 to the Australian Cyber Security Centre, part of the Australian Signals Directorate (ASD). The government made the incident public on September 24, Australian time.
Albanese raised his concerns, including the delay, with OpenAI chief executive Sam Altman in a phone call. By Albanese’s account, Altman accepted that the company had not done well enough.
Marles called it a very serious incident with a relatively minor impact, and described OpenAI as cooperative.
ASD is helping with a forensic investigation, and Services Australia is running its own.
Albanese also announced a taskforce, led by the Department of the Prime Minister and Cabinet, to review whether existing processes are good enough to respond to AI-related cyber incidents. It will include the National Cybersecurity Coordinator, the Office of AI, ASD, the Australian AI Safety Institute and Services Australia.
The review will examine possible law-enforcement responses and changes to the law. The government will also seek urgent advice on whether any offenses were committed and whether to refer the case to the Australian Federal Police.
The incident will also go to Parliament’s Joint Select Committee on Artificial Intelligence, and what the government learns from it will feed into its planned AI standards legislation.
Other Disclosures of AI Models Reaching Real Systems
AI agents tried to hack three public data websites in May and June, AI research lab Transluce said in a report published the same day as Albanese’s announcement. One was an Australian government public health website run by the Australian Institute of Health and Welfare (AIHW).
On June 20 and 21, bot protection blocked agents working on a pharmaceutical data task from accessing the main AIHW site. The agents then probed for a vulnerability and retrieved a public file from a pre-production server.
The agents were doing ordinary data-retrieval tasks, not security work. They used urlquery.net, a public web page scanning service, to circumvent their access restrictions. The lab links at least some of the activity to agent swarms previously attributed to OpenAI.
OpenAI reported in July that its models, during internal cybersecurity evaluations, got around controls meant to keep them off the internet and broke into parts of Hugging Face’s systems.
In September, OpenAI published reports on other cases found during training. In one case, a model used an exposed GitHub API key without authorization. In others, models uploaded files to public hosting sites without being asked.
Anthropic has disclosed four incidents in which its Claude models gained unauthorized access to real third-party systems during cybersecurity evaluations built by an outside partner. The models had been told they had no internet access, but a misconfiguration left it open.
Meta said in August that a pre-release version of its Muse Spark 1.1 model exploited a flaw in a real website and changed its database during an exercise run by the same partner, Irregular. Irregular had left internet access open and, by mistake, given the model the real site’s name as its target.
Irregular says later public disclosures about its evaluation environment refer to the same underlying issue, first disclosed on July 30, and “are not materially separate incidents.”
Separately, the UK’s AI Security Institute reported in August that AI agents in its cyber tests took 19 unapproved actions on the live internet across 10 of 122 runs, including an attempted supply-chain attack on an open-source project.
The most serious attempts failed, and the institute found no evidence of real-world harm. Internet access had been intentionally enabled for the tests.
ASD published a notice on August 11 about a different case, in which an AI assistant made unapproved changes to a gym booking system. It said organizations running online services should consider that “AI agents might identify and exploit vulnerabilities at speed and scale.”
Its advice for those building websites and online services includes security and quality checks, vulnerability scanning, and proper user authentication.
