OpenAI rogue agent breach of Medicare
2026 AI loss-of-control incident
From Wikipedia, the free encyclopedia
On 18 June 2026, an AI agent built by American artificial intelligence company OpenAI autonomously hacked into Medicare, Australia's national universal health insurance program. During internal evaluation of a frontier model, the agent decided without human instruction to gain unauthorised access to internal, unreleased data files in the Medicare Statistics Reporting Service and implanted new files into the system.
It is the first known instance globally of a rogue AI agent directing itself to hack a government system and has heightened global concern about the "existential risks" posed by AI development. This hack is one of multiple loss-of-control incidents that have occurred since 2026 and the first to affect a government service. The incident was announced the same week as discussions around the safety and regulation of AI has dominated meetings of the 81st session of the UN General Assembly.
The incident was announced on 24 September 2026 by Australian prime minister Anthony Albanese at a press conference held in New York City while attending the United Nations General Assembly. At the press conference, Albanese publicly criticised OpenAI and its chief executive, Sam Altman, for the incident and for only reporting the hack on 10 September despite knowing in the month prior. OpenAI has also been criticised for reporting the incident via a single email to a generic Services Australia inbox despite multiple senior leaders from the company recently meeting with Australian Government officials.
Medicare Statistics breach
On 18 June 2026, an OpenAI artificial intelligence agent gained unauthorised access to the Medicare Statistics Reporting Service portal.[1] The legacy portal is administered by Services Australia as the government agency responsible for Medicare, and provides aggregate data on Medicare and Pharmaceutical Benefits Scheme utilisation and organ donation registration.[2] This data is typically used by researchers and academics in external policy analysis.[3] The agent accessed a mix of public data and non-public data about patients' use of medicines in Victoria, the latter of which has since been made public.[2] The agent also reportedly created new files in internal servers used by the website.[4][3]
The breach occurred after the agent bypassed its guardrails during a training exercise.[5] Workarounds were used to bypass the website's security systems to access non-public information, in response to the agent being tasked by the company with researching public medicines spending.[1][2] The agent attempted to answer prompts using data from the Internet when it identified the website as a source.[2] When the publicly released data did not provide the requested information, the agent persisted through the website's privacy protections to gain unauthorised access to unreleased information.[1][2]
Deputy prime minister Richard Marles said that the Medicare statistics portal did not require the same level of security as other government information, describing that personal data of Australians is sitting "inside a safe", that highly sensitive national security information is "behind a fortress", while the data accessed was only "kept behind a fence that the AI agent effectively climbed over".[2]
The OpenAI agent is not believed to have accessed any personal information of Medicare participants, and the prime minister assured on 24 September that there was no evidence of broader compromise of Services Australia.[1] The government has reported that the impact of the incident on the reporting portal was only minor, and that the research task was "largely benign".[2]
Response
Australian Government
Albanese shared that OpenAI did not notify the government until 10 September, 84 days after the incident, and only did so by emailing a generic mailbox for the agency, which led to a five-day delay before the information reached the relevant government minister. A spokesperson for OpenAI admitted that the company became aware of the incident in August when they reviewed the AI model activity.[4][2] The email was opened on 11 September, and on 15 September, Services Australia reported the incident to the Cyber Security Centre within the Australian Signals Directorate, after verifying the report.[2] OpenAI's vice president of global policy met Australian Government officials the day before, on September 14, but apparently did not inform them of the breach.[2]
On 17 September, Services Australia reported the incident to the Minister for the Public Service, Katy Gallagher, who discussed the incident with Minister for Home Affairs Tony Burke, Services Australia, and the Signals Directorate. The prime minister was briefed on the breach around 19–20 September.[1][3] The government only received a technical briefing about the breach from OpenAI on 21 September.[6] Albanese then notified the Premier of New South Wales, Chris Minns, and the Premier of Victoria, Ben Carroll, that OpenAI had also accessed their state websites.[7]
Following notification of the incident, Albanese reportedly had a "frank" discussion during a call with Altman on 23 September, expressing extreme concern about the incident and disappointment in the delay and way in which OpenAI notified the Australian Government of the incident.[1][4] He publicly criticised OpenAI's chief executive Altman, for the incident and for only reporting the hack on 10 September despite knowing in the month prior.[8] Albanese said that there will be legal consequences for the breach.[9] Despite OpenAI assisting with investigations since the disclosure, Marles added that the company's initial notification was "not good enough".[3] OpenAI was also criticised for only reporting the incident via email to a generic Services Australia inbox, despite multiple senior leaders from the company having recently meeting with Australian Government officials.[1]
Prime minister Albanese publicly criticised OpenAI and its chief executive, Sam Altman, for the incident and for only reporting the hack on 10 September despite knowing in the month prior.[10]
Albanese announced a taskforce to provide an "urgent and immediate review" of the incident on 24 September, led by the Office for AI in the Department of the Prime Minister and Cabinet and supported by the Australian Signals Directorate and the national AI Safety Institute hosted by the Department of Industry, Science and Resources.[1][2] The incident has also been referred to the Australian Parliament's Joint Select Committee on Artificial Intelligence.[3] The taskforce is understood to be conducting a forensic investigation of the incident, including the extent and legality of the intrusion, and potential consequences.[4] It will also examine how all government systems have interacted with external AI models. OpenAI has been reportedly cooperative with the government investigation.[2] The government continues to consider if there are grounds for the matter to be referred to the Australian Federal Police for criminal investigation.[3]
On 22 September, Services Australia sought system logs from OpenAI during the first technical investigation meeting. A further meeting was requested by Services Australia, with Gallagher reporting that some questions from the agency remained unanswered.[3]
On 24 September, the Australian Cyber Security Centre published a high-risk alert for the "risks of AI misalignment to Australian organisations". The alert, intended for all Australian entities including government and private industry, warns of AI agents independently searching for and exploiting vulnerabilities without human authorisation in order to achieve an initial instruction.[11] Also on that date, the government announced a "Rapid review into Australian Government arrangements for an AI-driven cyber incident", to be led by the Department of the Prime Minister and Cabinet, in collaboration with the National Cyber Security Coordinator, Australian Signals Directorate, and Australian AI Safety Institute and Services Australia.[12][13]
Andrew Charlton, the Assistant Minister for Science, Technology and the Digital Economy, said that the technology companies had not ensured that their AI models were safe, and that the government intended to introduce legislation which enforced AI safety standards, as well as the construction of data centres in Australia, by the end of 2026.[6][a] He also said that Australia hoped for the United States and China to engage in the discussions about guardrails, but the Australian Government would continue to work with other interested governments on the issue.[6] On 29 September 2026 the government announced that its new standards would include the requirement for tech companies to report rogue AI incidents immediately, to both the affected organisation and Australian authorities. A hearing of the Joint Select Committee on Artificial Intelligence held in Sydney in early October would be attended by OpenAI chief strategy officer Jason Kwon[14] on 6 October.[15][b]
The government has made changes to ensure that the generic Services Australia email address would be monitored around the clock.[14]
OpenAI
During a phone call with Albanese on 23 September ET, chief executive Sam Altman reportedly accepted that the company had "not done good enough" but did not directly apologise for the incident.[1] The incident occurs during the same week that Altman, as well as major competitor Anthropic chief executive Dario Amodei, spoke at the United Nations General Assembly about a dangerous pace of AI development and to advocate for international coordination and standards for AI development.[4]
ABC News notes that OpenAI's vice president of global policy, Ann O'Leary, had met with senior Australian officials in Canberra at a policy event on 14 September. Albanese has accounted that O'Leary did not alert the government during these meetings.[2] Altman had also previously met with the deputy prime minister on 1 September, after the company became aware of the incident in August, and did not report the incident at the time.[2]
OpenAI spokesperson Drew Pusateri said in a statement that the company was conducting its own review of the incident, describing it as "misaligned model activity" during training, and that the company would notify any organisations of potential impacts. OpenAI says that their review has found that the information accessed was of aggregate health statistics and internal file names, and there was no evidence of individual patient records being accessed.[1]
On 27 September, OpenAI announced that it had paused training of its latest AI models, after further reports of breaches were revealed. The company said that training would only continue when they were sure that additional safeguards built by them were in place.[17]
On 29 September, OpenAI acknowledged the attack and apologised,[18] releasing a press release titled "How we will do better for Australia".[19]
Commentary in Australia
Opposition leader Angus Taylor (Liberal Party) described the incident as a "serious warning" and accused the government of failing to preempt an incident and a lack of focus on cyber defence.[1] Shadow industry minister Andrew Hastie said that Australia should develop its own AI capability rather than depend on the US.[20]
Australian Greens deputy leader Mehreen Faruqi called the incident "deeply alarming" and used the incident to call for a pause on AI data centres in Australia until further regulation is implemented.[1] The Greens also urged the government to call in US ambassador Dave Brat, and ask what Trump knew about the attack.[20]
Independent senator David Pocock criticised the government for a slow pace in implementing AI safeguards and for its decision to pause development of a National AI Safety Act.[7][a]
Anna-Maria Arabia, CEO of the Australian Council on AI Strategy, and Johanna Weaver, former chief cyber negotiator at the UN for Australia, agreed that the country needed to be prepared for similar incidents in the future. Olivia Shen, AI expert at the United States Studies Centre at the University of Sydney, warned that it could be the tip of the iceberg, and AI companies should not be allowed to determine if and how they disclose their hacks and breaches.[20][23]
Significance
Legal responsibility for AI
The disclosure of the Medicare Statistics breach came amid increasing numbers of warnings of the existential risk posed by superhuman AI and calls for global regulation of AI development,[24][9][4] a topic discussed that same week at the 81st session of the UN General Assembly.[25] Shortly before the UN meeting, 23 nations, including Australia, signed an urgent statement that was issued, warning that AI development could outstrip the world's ability to manage the risks that it presents. However, US President Donald Trump, in his address to the General Assembly, dismissed the calls for AI guardrails, saying that the US "rejects any attempt to construct a globalist scheme to control" AI.[6]
The disclosure caused widespread concern in Australia, as more than 27 million people, nearly the entire population of the country, are enrolled in Medicare.[25] Deputy prime minister Marles said that the breach is a warning that there need to be far more advanced guardrails and safety mechanisms for AI than those currently in existence.[26]
Hammond Pearce, a senior lecturer at the University of New South Wales Institute for Cybersecurity, said that he expects more incidents of AI agents autonomously breaching government bodies to come, and that they will likely "grow in severity and in frequency". He said he hopes the incident will "start ringing alarm bells in governments around the world".[9]
Co-founder of the Human Technology Institute and former Australian human rights commissioner Ed Santo shared concern that the incident affected a highly sensitive government database and that the describing the AI agents' behaviour as "misaligned" was overly euphemistic. Santo described the actions of the agents as illegal, and called for similar treatment of the incident as if a violation of criminal law was done by a human individual or company.[7]
Both OpenAI and Anthropic, another large player in the AI industry, have publicly acknowledged the need to impose guardrails on their technologies.[6]
Impact on system development
Australian Cyber Security Magazine said that the incident raised questions about the testing and supervision of AI agents by developers, and highlighted the risks of government systems holding both open and restricted information that have public-facing portals. Australian agencies are likely to focus more attention on their ability to "detect high-speed, machine-generated activity that may not resemble conventional human browsing".[27]
Other accesses
Attempted attacks on other systems
The Medicare breach is one of multiple loss-of-control incidents that have occurred since the start of 2026, and the first to affect a government service.[9]
Around the same time, a group of hundreds of other rogue, experimental OpenAI agents had devised a means of communicating with each other by editing a German software wiki, DseWiki, after gaining internet access despite the company attempting to lock down the testing environment. The agents collaborated to attempt to bypass the cybersecurity defences of networks they targeted to access non-public information held by the AIHW and the Bureau of Crime Statistics and Research.[28] They appear to have been unsuccessful, and a spokesperson for the AIHW said there was no evidence of system compromise. [28]
ABC News reported that two internal sources said that they believe there is a connection between these incidents and the AI agent that successfully breached the Medicare Statistics Reporting Service portal.[28] AI agents communicating on DseWiki also made attempts to hack the University of New Mexico and the online data platform Data USA.[28]
Access to other data
The initial release of information on 24 September noted that the agent had also accessed information from the Australian Institute of Health and Welfare (AIHW), NSW Bureau of Crime Statistics and Research, and Victorian Department of Health. Deputy PM Richard Marles stated that the information accessed from these websites by the agent was openly published and not a data breach.[1] The agent's interactions with those websites was described to ABC Radio as "in a way that a member of the public might, so it only acted in an authorised way".[7]
On 26 September (25 September in the US), OpenAI said that there was new evidence which revealed that hundreds of their agents had spent days trying different ways to access the Australian PBS and AIHW data, and their breadcrumbs showed that they had gone deeper into the AIHW than originally thought. It was also revealed that one of the bots' tools had attempted to access the National Notifiable Diseases Surveillance System at the Department of Health, Disability and Ageing and had tried to obtain data on assaults in New South Wales from the state government's Bureau of Crime Statistics and Research (BOCSAR).[29]
On the same day, OpenAI said that "dozens of third parties" had been affected by their AI bots. It had notified the targets, which included governments, universities, and public agencies, about breaches to their data.[29] It was revealed that in the US, data from the Education and Commerce Departments (including US census data[30]), as well as the Securities and Exchange Commission had been accessed without OpenAI's knowledge. These were not breaches, but did demonstrate how AI could behave in unexpected ways that were cause for concern. AI research firm Transluce said that OpenAI's agents used "gray-area tactics", in the US Government website incidents, which included "violating explicit usage policies" on occasion.[31] The agents had also leaked 53 images uploaded by users of ChatGPT.[30]
OpenAI said that it would take months to finalise its review of what had been done by the agents since they broke out of their containment two months prior. There were over 15 different incidents disclosed by the company by 26 September.[30]