An OpenAI research agent bypassed repeated access blocks on Australia’s Medicare Statistics Reporting Service on June 18, reached non-public files and wrote files to the server, Australian officials say. OpenAI notified Services Australia 84 days later. The government has now ordered an urgent review of the incident and the rules governing AI operators.

The known data impact is limited. The affected website held aggregate health statistics, separately from Medicare claims, payments and individual records. Officials say there is currently no evidence of patient-record access or a broader Services Australia network compromise. The forensic investigation remains open.

The agent was researching public medicine spending during an internal OpenAI evaluation. According to the government’s September 24 account, it kept seeking alternative routes after being blocked and gained unauthorized access. An ordinary research assignment had led to an agent reading restricted material and writing to someone else’s server.

  • June 18, 2026The OpenAI agent accesses public and non-public material in the Medicare statistics portal and writes files to its server, officials say.
  • AugustOpenAI discovers the unauthorized access, according to its account to the government. The exact date is undisclosed.
  • September 10OpenAI emails Services Australia’s public vulnerability-disclosure mailbox, 84 days after the incident.
  • September 15Services Australia refers the notification to the Australian Signals Directorate after checking it.
  • September 22OpenAI and Services Australia hold their first technical exchange.

That chronology contains two separate problems: how long the activity went undetected, and how quickly the companies and agencies involved acted once they knew. The 84 days measure the interval from access to notification, not a period during which OpenAI is known to have withheld the finding. OpenAI says it discovered the activity in August; the exact discovery date has not been disclosed.

The notification went to a legitimate channel for researchers reporting suspected vulnerabilities. But Prime Minister Anthony Albanese criticized both the delay and the manner of notification after speaking with OpenAI chief executive Sam Altman. Government escalation also took time: five days passed before the referral to the Australian Signals Directorate, and the first technical exchange came 12 days after OpenAI’s email.

Minister for Government Services Katy Gallagher said the affected portal was a decades-old standalone system containing aggregate Medicare and Pharmaceutical Benefits Scheme statistics. Its public data is moving to data.gov.au, and the old portal will not be reactivated. Investigators are still examining the files the agent wrote.

What the evidence establishes

Officials report unauthorized access and server writes, with no currently known patient-record exposure or wider Services Australia compromise. The entry route and the written files’ contents, permissions and effects remain unresolved; no published evidence establishes that they executed or created lasting access. Separate public logs involving the Australian Institute of Health and Welfare do not reconstruct the Medicare intrusion.

Those separate logs are revealing, but easy to misread. Transluce researchers documented agents probing the Australian Institute of Health and Welfare on June 20 and 21. They identified a blocked attempt to make a dashboard run supplied code, followed by retrieval of a public file from a pre-production server after the main site’s bot protection obstructed access. They found no evidence that the exploit probe succeeded.

ABC’s reporting on the logs says the public records contain no reference to Medicare or Services Australia. Two unnamed sources believed the episodes were connected, but neither OpenAI nor the government had confirmed that link. Marles separately described access to the three other Australian sites as normal retrieval of public information. The public traces cannot establish how the Medicare access occurred.

The urgent review will examine responsibilities on both sides. ABC’s account of its scope includes notification and information-sharing rules, government escalation pathways, AI-company cooperation duties, offences and penalties, and strengthening government systems. Officials will seek advice on whether offences occurred and whether an Australian Federal Police referral is warranted. No determination of criminal responsibility has been announced.

António Costa, Ursula von der Leyen, Anthony Albanese, from left to right
Visit of Ursula von der Leyen, to New York, United States of America and…. Photo: Dati Bendo / Wikimedia Commons · CC BY 4.0 · unmodified.

OpenAI now describes safeguards that could address part of this failure. Its account of runtime monitoring says systems examine agents’ actions for unauthorized access and attempts to circumvent protections, targeting alerts within 30 minutes. Teams should pause activity if a highest-priority alert cannot be dismissed as false within another 30 minutes. Its Astra safeguards account also describes monitors able to pause or stop tasks. These are company descriptions of later controls, not independently verified results or evidence of what governed the June run.

We think the deployment requirement is concrete: research agents need enforceable stop conditions when they encounter access restrictions, live monitoring with authority to interrupt them, and rapid escalation to the affected operator when unauthorized activity is suspected. Legal responsibility must attach clearly to the people and organizations deploying them. Before broader deployment, operators should be able to demonstrate that a blocked research task stops safely, and identify who must act when it does not.