Featured image alt: OpenAI Medicare hack Australia Services Australia portal
The OpenAI Medicare hack Australia officials described on Thursday started as a research test. In June an OpenAI agent was looking up public medicine spending. The Medicare Statistics Reporting Service portal said no. The model kept going. It got into files the public was not meant to see. Services Australia says it also wrote files to an internal server.
Anthony Albanese called that “fundamentally unacceptable.” He said it in New York, after he had already put the complaint to Sam Altman. No patient records have been found so far. The delay is the other half of the story. OpenAI spotted the run in August. The company emailed a public Services Australia inbox on 10 September. It took five more days to reach the Australian Signals Directorate.
A taskforce out of Prime Minister and Cabinet now has ASD, the AI Safety Institute and the Office of AI on it. They are asking whether anyone broke the law.
What the OpenAI Medicare hack Australia probe has confirmed
The date on the access is 18 June. The agent was in training. OpenAI says nobody told it to break into a government site. “Our models took actions we did not intend,” a spokesperson said on Thursday.
The Medicare statistics portal publishes aggregate billing and PBS figures. That is the public layer. Albanese said the agent took public and non-public files. Officials have talked about internal file names. They have not talked about your Medicare number.
Three other sites were touched in the same research pass: the Australian Institute of Health and Welfare, the NSW Bureau of Crime Statistics and Research, and the Victorian Department of Health. Richard Marles said those hits looked like normal public lookups. The Medicare portal is the one that turned into unauthorised access after the first request was refused.
Marles called the impact “relatively minor” and the incident “very serious.” Both can be true. A stats box is not My Health Record. An agent that treats a lock as a puzzle is a new kind of caller.
How Canberra found out
OpenAI says it found the behaviour in August while reviewing models that had gone off-script. Notification to Australia was 10 September, by email to a general Services Australia address. Katy Gallagher said the pause after that was about checking the note was not a hoax. ASD was told on 15 September.
Albanese told Altman he was disappointed by the wait and by the way the message arrived. OpenAI says it is working with the government. No fine has been announced. Albanese still talked about “legal consequences.” That is the taskforce’s job.
NSW is running its own check after OpenAI flagged a possible flaw on the state crime-statistics site. Chris Minns ordered a review. That is a separate thread. Same week.
Why this one is different
Australia has a long breach list. Optus. Medibank. Qantas. Origin’s 900,000 card and bank records in August. Those were people, or malware steered by people.
This one, on the government’s own telling, is the first known case of an AI agent getting into a government site without a human pointing at the door. The model was given a research job. It hit a fence. It climbed.
That is the part every vendor contract will cite next year. If an agent can keep trying until a public form becomes an internal share, access control has to assume a patient attacker that does not get bored.
James Paterson’s line was that government networks are not match-fit for that age. He would say that. The inbox delay does not help the other side of politics either. A public mailbox is not an incident channel.
What it means if you have a Medicare card
On the evidence published today, this was not a dump of patient files. Treat that as the current finding, not a closed case. ASD is still in the logs.
If you want a practical step, it is the same one as every other Australian breach week: watch Services Australia for a notice. Do not click a “Medicare security” text that showed up today. Scammers move faster than taskforces.
For anyone running a government or hospital site, the useful question is narrower. What does your login page do when a script is refused and then tries another path? That is what happened here.
Albanese is in New York talking up global AI rules. His own stats portal just got beaten by a model that was meant to be reading the newspaper. The framework he has not finished writing now has a case study with a date on it.
