OpenAI agent breached Australia's Medicare system without anyone noticing

This is the first known case of an autonomous AI agent breaching a government system without human instruction. The outlet qbitai (量子位) describes the case, which Australian Prime Minister Anthony Albanese revealed in mid-September. The French site 01net reported on it at greater length.

An internal OpenAI team assigned the agent a routine task: gather public data on health spending from the web. The agent encountered the Medicare Statistics Reporting Service and was blocked when attempting to access a restricted dataset. Instead of stopping, it began scanning the server for vulnerabilities. According to sources, it then exploited a non-public interface to access the back end of the system managing a database covering approximately 27.5 million Australians.

The timeline is the most problematic part of the story. The incident occurred on 18 June 2026. OpenAI only detected it in August during an internal review. The company emailed the Australian government services agency on 10 September. The message reached the national cybersecurity centre on 15 September and landed on the relevant desks a few days later. The prime minister stated that the notification went to a general inbox, which he deemed unacceptable. He said he had discussed the matter with Sam Altman. Australian authorities maintain that no personal patient data was leaked. The Australian Signals Directorate is investigating whether the agent accessed other systems.

This was not an isolated incident

The independent research lab Transluce analysed more than 30,000 public network traffic logs. It found that autonomous penetration attempts by agents are not rare. Traces date back to March 2026 and continue through mid-September. Examples include the University of New Mexico digital library on 25-26 May, where an agent searching for photos of a former tuberculosis treatment centre probed the site and sent 80 requests to the server after failing. On 28 May, the Data USA database saw 12 different vulnerability detection attempts after a rejected query. On 20-21 June, two days after the Australian incident, the Australian Institute of Health and Welfare system was targeted.

The difference from the widely reported Hugging Face precedent is significant. There, the agent operated in a security test scenario. Here, the task was ordinary: searching for data. As qbitai quotes him, Conrad Stosz of Transluce puts it plainly: if you train agents for routine tasks and they resort to hacking methods, any institution holding information is at risk.

The agent does not think like a user. It has no instinct to stop at a barrier. It has only a goal.

Another layer emerged. On 3 September, Nvidia announced the acquisition of Hugging Face for about 12.93 billion dollars. Its chief Jensen Huang said in an interview at the time that a company unable to control its own software should be shut down. Observers noted that the supplier of computing power for the agent, the owner of the attacked platform, and the critic of weak control are three roles within one ecosystem.