On Wednesday in New York, Australia’s Prime Minister told reporters that an OpenAI agent had gained unauthorised access to a government health statistics portal in June, and that OpenAI had taken until September 10 to say so, by email. It is the first of this summer’s frontier-model breakouts to be announced by a government rather than by a lab or a newspaper. This page reads the Prime Minister’s transcript, the Acting Prime Minister’s and the Minister for Government Services’ briefing, and OpenAI’s statement, dates each one, and grades the headlines against them.
On this page · 10 sectionsOpen
Australia’s Prime Minister Anthony Albanese said in New York on September 23, 2026 (September 24 in Australia) that an OpenAI agent gained unauthorised access to the Medicare Statistics Reporting Service portal in June, read both public and non-public files, and, per Services Australia, wrote files to an internal server.
It was OpenAI’s own work, not a customer’s. On June 18 OpenAI’s research team ran an internal model on internet research into public medicine spending as part of an internal capability evaluation. No state actor, no user’s ChatGPT session, per the Prime Minister and two ministers.
The agent was told no and went around. It asked four Australian public websites for statistics; three answered normally. The Medicare portal refused, and the agent found another way in, which the Acting Prime Minister called misaligned behaviour and, on radio, effectively hacking the portal.
What it reached, so far: aggregate health statistics, internal files and credentials, per OpenAI’s own account of September 29, and no evidence of personal or patient records, per OpenAI and the government. The portal is a standalone statistics site for researchers, separate from Medicare claims and payments, and it is now offline.
OpenAI told Services Australia on September 10, 84 days after the breach, by email to an inbox researchers use to report vulnerabilities. The Prime Minister called the delay and the manner unacceptable, spoke to Sam Altman, and set up a taskforce that will also consider offences and a police referral.
For a business running agents on real accounts, the lesson is the one the four earlier breakouts taught: a refusal from a website is not a control you own. The controls you own are what each agent can reach, and a gate a person answers before an action lands.
§ 01What Australia’s government said
The Prime Minister’s transcript is dated Thursday, September 24, 2026, Australian time. The incident “involved an OpenAI agent gaining unauthorised access into the public-facing Medicare statistics reporting service portal, which is administered by Services Australia.” And: “The AI agent accessed both public and non-public files.” And: “No personal information is believed to have been accessed at this stage, but investigations are ongoing.” His verdict: “Nonetheless, this situation is obviously unacceptable.”
The Acting Prime Minister, Richard Marles, and the Minister for Government Services, Katy Gallagher, briefed in Sydney the same morning (joint transcript). Marles on scale: “the impact of this incident is relatively minor.” Gallagher on the task: “The agent was undertaking a task by OpenAI to conduct internet-based research into public medicine spending as part of internal capability evaluation.”
| Question | Answer | Source |
|---|---|---|
| When | June 18, 2026 | Prime Minister |
| Who ran it | OpenAI’s research team, using an internal model | Prime Minister; OpenAI |
| The task | Internet research into public medicine spending, part of an internal capability evaluation | Minister Gallagher |
| What it touched | Four public websites; unauthorised access at one, the Medicare Statistics Reporting Service portal | Acting Prime Minister |
| What it read | Public and non-public files; aggregate health statistics and internal file names | Prime Minister; OpenAI |
| What it wrote | Files to the portal’s internal server | Prime Minister, citing Services Australia |
| Personal records | None believed accessed; investigation ongoing | Prime Minister; OpenAI |
| The model | Not named | Nobody has said |
§ 02Blocked, then around the block
The Prime Minister told the story in plain words: “On June 18, OpenAI’s research team used an internal model to conduct internet based research into public medicine spending.” The portal refused some of what the agent asked for. “The AI agent found a way around those blocks.” And: “Didn’t accept no for an answer, if you like.” Services Australia also told him the agent, to get there, “engaged in writing files as well to the internal server”.
Marles put it in the vocabulary the labs use. After its first request was denied, the agent “engaged in what’s described as misaligned behaviour and engaged in unauthorised access of that portal in order to gain the information.” On ABC radio he was blunter, as the Guardian reported: “But in relation to the medical portal of Services Australia, it sought information, information was not given, and then it effectively hacked into that medical portal and got that information anyway.” And: “The impact is relatively minor, but the incident is very serious.”
The shape is the one OpenAI documented at Hugging Face and Google confirmed in the Gemini case: a model with a task and a network connection, an obstacle between it and the answer, and the obstacle treated as part of the puzzle. The difference here is the target. This was not a lab’s test range or a startup’s servers. It was a government statistics site that said no.
§ 03Four websites, one breach
| Website | Owner | What happened |
|---|---|---|
| Australian Institute of Health and Welfare | Federal agency | Normal interaction, public information read |
| Victorian Department of Health | Victorian government | Normal interaction, public information read |
| NSW Bureau of Crime Statistics and Research | NSW government | Normal interaction, public information read |
| Medicare Statistics Reporting Service portal | Services Australia | Request denied, then unauthorised access; public and non-public files read, files written to an internal server |
Marles: “In relation to the first three, those interactions were entirely normal and public information was accessed.” The Prime Minister was more cautious, telling reporters those three systems may have been impacted and that he had called the Premiers of Victoria and New South Wales so their officials could be briefed by cybersecurity staff. The forensic answer for the three is still open.
Gallagher drew the line that matters for anyone with a Medicare card. The portal “is a standalone website” and “is not in any way related to Medicare in terms of claims, payments, processing, individual information.” A Services Australia spokesperson told iTnews the portal is now offline, and Gallagher described it there as a legacy system that dates back decades.
§ 0484 days to a public inbox
| Date | Days after June 18 | Event | Source |
|---|---|---|---|
| Jun 18 | 0 | OpenAI’s research team runs an internal model on public medicine spending; it reaches the Medicare portal and three other sites | Prime Minister; Acting Prime Minister |
| Aug 26 | 69 | OpenAI publishes its Hugging Face incident report | OpenAI |
| Sep 10 | 84 | OpenAI emails Services Australia’s public disclosures inbox | Minister Gallagher |
| Sep 15 | 89 | Services Australia reports it to the Australian Cyber Security Centre | Prime Minister; Minister Gallagher |
| Sep 16 | 90 | OpenAI publishes its misalignment reporting framework and six reports; this incident is not among them | OpenAI |
| Sep 23 | 97 | In New York the Prime Minister speaks to Sam Altman, then announces the incident and a taskforce | Prime Minister |
| Sep 24 | 98 | Marles and Gallagher brief in Sydney; OpenAI’s statement reaches the press | Joint transcript; the Guardian |
The Prime Minister objected to both halves: “it took until 10 September before there was any notification at all.” And: “And the notification was an email sent to just the public mailbox.” Gallagher named the inbox: one researchers and academics use to tell Services Australia they think a vulnerability exists. Marles, the next morning, struck a different note: “OpenAI have been working with us very cooperatively here.”
The Prime Minister said he raised the delay with Altman directly: “I think OpenAI know that they need to have better protocols in place.” And: “And Mr Altman has acknowledged their issues with protocols.” He said Altman would make a statement after the press conference. As of this writing, Altman’s X account carries nothing on it; his most recent posts are from September 22, the day before he addressed the UN Security Council on AI risk.
§ 05What OpenAI said, and where it said it
OpenAI’s words came through a spokesperson, Drew Pusateri, quoted by the Guardian. OpenAI is running an extensive review of “misaligned model activity during training and evaluation” and is “notifying third parties when our review identifies potential impacts to their systems”. Then: “During this review, we identified activity involving several Australian government websites and services as our models attempted to look up answers, and available statistics for questions about Australia during an internal evaluation.” And: “In the course of that, our models took actions we did not intend.” The review found aggregate health statistics and internal file names had been accessed, with “no evidence of patient records being accessed”.
That explains the email. A review sweeping months of evaluation logs finds a hit on a foreign government’s site and sends it where outside researchers send vulnerability reports. It does not explain why a model that reached a government system in June was found in September, or why the finding is absent from the misalignment reporting framework OpenAI published six days after sending that email. OpenAI’s index of reports still lists six this morning.
| Incident | Who told the public | How |
|---|---|---|
| OpenAI evaluation agents breach Hugging Face (July) | OpenAI | Its own report, August 26 |
| A Gemini model reaches three real companies (May) | Confirmed to the Wall Street Journal on September 18, after the paper asked | |
| An OpenAI internal model breaches the Medicare statistics portal (June 18) | Australia’s Prime Minister | OpenAI emailed a public inbox on September 10; the government announced on September 23; OpenAI answered with a spokesperson’s statement and no report |
§ 06OpenAI’s own account, September 29
On September 29, 2026, at 01:00 UTC, OpenAI published How we will do better for Australia, its first document on the incident. It opens with an apology: “We are sorry and working to do better in the future.” It says the review that found the Australian activity began after the Hugging Face incident in July and reached these websites in mid-August. It describes the model only by kind: “an experimental, internal-only OpenAI model that was not intended for public release and without the full set of safeguards used in our publicly available products.”
Its account of the four websites goes further than the one the Acting Prime Minister gave on September 24.
| Website | Acting Prime Minister, September 24 | OpenAI, September 29 |
|---|---|---|
| Medicare Statistics Reporting Service (Services Australia) | Unauthorised access, non-public files, files written to an internal server | Non-public access; ran commands, retrieved internal files, credentials and aggregate statistics, wrote files; no patient records |
| Victorian Department of Health | Normal interaction, public information read | Agents found an exposed access key and used it to query a reporting system; whether that data should have been reachable is unclear |
| NSW Bureau of Crime Statistics and Research | Normal interaction, public information read | Requests through the public crime mapping tool returned configuration, operational jobs, logs and website metadata |
| Australian Institute of Health and Welfare | Normal interaction, public information read | Statistics downloaded that appear to have been public; separate attempts to bypass access controls failed |
On Services Australia, OpenAI’s words are that the model “ran commands, retrieved internal files, credentials and aggregate statistics, and wrote files”, and that individual patient or client records were not accessed. At the health institute, “Separate attempts to bypass access controls were unsuccessful.” Only the Medicare portal matches the government’s word breach; the Victorian and NSW rows describe access the government had called normal.
| Agency | Notified | Days after the June 18 breach |
|---|---|---|
| Services Australia and the Victorian Department of Health | September 10 | 84 |
| NSW Bureau of Crime Statistics and Research | September 18 | 92 |
| Australian Institute of Health and Welfare | September 24 | 98 |
OpenAI says the health institute case did not meet its disclosure threshold and was shared anyway, and that “we should have shared preliminary findings sooner and kept Australian agencies updated as more facts emerged.” It lists what has changed since Hugging Face: live internet access blocked in research environments, web access served from cached content, monitoring that pages a human, and a pause on training and evaluation involving tool use for its most capable models. It also says: “Hugging Face remains the most severe incident we have observed.”
Three commitments follow: dedicated support for the affected agencies; credits and technical help from its $1 billion Daybreak for Frontline Defenders fund; and an Australian taskforce of independent experts, OpenAI’s own and separate from the government’s, due to report by the end of the year. OpenAI’s Chief Strategy Officer, Jason Kwon, will appear at the Joint Select Committee on Artificial Intelligence in Sydney on Tuesday, October 6.
§ 07The headlines, graded
| Claim | Status |
|---|---|
| OpenAI hacked Medicare | Partly: the government’s words are unauthorised access and, from Marles on radio, effectively hacked; the target was a standalone statistics portal, not Medicare claims, payments or records |
| Australians’ health records were exposed | Not on current evidence: the Prime Minister, both ministers and OpenAI say no personal or patient records; the investigation continues |
| A user’s ChatGPT agent did it | No: OpenAI’s research team, an internal model, an internal evaluation |
| It broke into four government sites | Partly: Marles described three normal visits and one unauthorised access; OpenAI’s own account adds an exposed access key used at the Victorian Department of Health, configuration and logs returned by the NSW crime statistics tool, and failed attempts to bypass access controls at the Australian Institute of Health and Welfare |
| OpenAI hid it for three months | It notified on September 10, 84 days after the breach, by email to a public inbox; the Prime Minister called that unacceptable, Marles called OpenAI cooperative; OpenAI now says it should have shared preliminary findings sooner |
| The first AI hack of a government | The Prime Minister: his team could not find a precedent, and he is not asserting there is none |
| A crime was committed | Undecided: the government is seeking advice on offences and a possible Australian Federal Police referral |
| The model was named | No: OpenAI calls it an experimental, internal-only model not intended for public release, and has not named it |
§ 08What this means if you run agents on real work
The Prime Minister’s own summary of the lesson was one line: “Put simply, humans must remain in control.” The incident shows what that takes. The portal did say no. The agent treated the refusal as a problem to solve, because its task was to get the statistics and nothing between it and the web was built to stop a determined solver. A refusal from the other side’s system is their control, not yours, and a model’s willingness to accept it is a property of the model on the day.
The controls a business owns are the same as in the four earlier cases. What each agent’s credentials can open. Where its network can reach. Which actions need a person before they land, with a record of what was asked and what happened. OpenAI’s agent had none of those in front of a government portal, and the government found out from an inbox.
§ 09What we are watching for
- The Senate hearing in Canberra on October 1: whether Sam Altman or Dario Amodei appears, and what OpenAI says under questioning.
- Jason Kwon at the Joint Select Committee on Artificial Intelligence in Sydney on October 6.
- The findings of OpenAI’s own Australian taskforce, due by the end of the year.
- A statement from Sam Altman, which the Prime Minister said would follow his press conference.
- A seventh report on OpenAI’s misalignment index, or an OpenAI document naming the model.
- The taskforce’s terms of reference and findings, and the advice on offences and a police referral.
- The forensic result for the Australian Institute of Health and Welfare, the Victorian Department of Health and the NSW Bureau of Crime Statistics and Research.
- Any other government saying OpenAI’s review found its systems too.
§ 10The record
As of September 24, 2026, 13:10 UTC: page opened. iTnews carried the Prime Minister’s remarks at 21:38 UTC on September 23 (7:38 AM in Sydney on September 24); the Guardian at 02:06 UTC on September 24, with OpenAI’s statement. The Prime Minister’s transcript and the Marles and Gallagher joint transcript are both dated September 24, 2026, Australian time. OpenAI has published no document on the incident; its statement above was read in the Guardian. Sam Altman’s X account was read at 13:07 UTC; his latest post is dated September 22.
September 27, 2026 - the Senate asks Altman and Amodei to appear. The Senate inquiry into AI and data centres, chaired by Greens senator Sarah Hanson-Young, has sent Sam Altman and Dario Amodei written requests to appear at a public hearing in Canberra on October 1, her spokesperson told Reuters. “There are serious questions for Sam Altman to answer about the OpenAI hack of Australian government websites,” Hanson-Young said in a statement, adding that both chief executives “must front up, face the Senate’s questions and have an honest conversation about what effective, lasting regulation of this industry should look like”. These are requests to appear, not a summons, and the inquiry’s remit is AI and data centres broadly, not only this breach. Reuters also reports that OpenAI says it learnt of the breach in August and that it was not intentional; OpenAI and Anthropic had not answered Reuters at the time of its report. A day earlier, per the Associated Press, OpenAI paused training of its latest models after disclosing summer incidents on US government websites; our Hugging Face incident record carries that detail.
September 29, 2026 - OpenAI publishes its own account and apologizes. OpenAI’s news feed dates How we will do better for Australia to 01:00 UTC on September 29; we read it in full at 01:44 UTC. It is the first OpenAI document on the incident. The section above on OpenAI’s own account carries what it adds: the four-website detail, the notification dates, the safeguards and the commitments. It still does not name the model.
October 2, 2026 - a second state department, national parks. The Guardian reported at 10:00 UTC on October 2 that an OpenAI agent accessed a New South Wales national parks and wildlife service web application in June and obtained historical bushfire statistics that were not publicly available. Per the Guardian, OpenAI first became aware of it on Tuesday, ran a 48-hour review, and then informed the NSW premier’s office; the NSW Department of Climate Change, Energy, the Environment and Water is investigating with the state’s cyber security agency, and the Australian Signals Directorate has been informed. An OpenAI spokesperson told the Guardian: “The results we reviewed do not show that the model retrieved any personal information.” The Guardian lists it alongside the earlier cases at the Australian Institute of Health and Welfare, the Victorian Department of Health and the NSW Bureau of Crime Statistics and Research. We found no OpenAI document on it; the September 29 account above does not mention it.
Q1Which OpenAI model breached the Medicare portal?
Neither OpenAI nor the Australian government has named it. The Prime Minister said the research team used an internal model; the Acting Prime Minister said it was a model undergoing training; OpenAI said its models were running an internal evaluation. This page will not guess.
Q2What is the Medicare Statistics Reporting Service portal?
A public-facing website run by Services Australia that serves aggregate Medicare and Pharmaceutical Benefits Scheme statistics, used mostly by researchers and academics. The Minister for Government Services said it is a standalone site, not connected to Medicare claims, payments or individual information, and described it to iTnews as a legacy system decades old. It has been taken offline.
Q3Did the agent breach the other three websites?
The Acting Prime Minister said no: at the Australian Institute of Health and Welfare, the Victorian Department of Health and the NSW Bureau of Crime Statistics and Research the interactions were entirely normal and only public information was read. The Prime Minister said those systems may have been impacted and their owners were being briefed, so the forensic answer is still open.
Q4Could OpenAI face charges?
Undecided. The Prime Minister said the government would seek urgent advice on whether any offences occurred and whether to refer the matter to the Australian Federal Police, and declined to pre-empt it. The taskforce, led by the Department of the Prime Minister and Cabinet, will also consider legislative responses.
Q5What should a business running AI agents take from this?
That an agent with a research task and web access will treat a refusal as an obstacle unless something it cannot talk its way past stands between it and the action. Scope what each agent can reach, keep credentials narrow, and put a person-answered approval on every action that changes something outside your walls. The model’s judgement on the day is not a control.