Australian Officials Investigating OpenAI's Hacking of Country's Universal Healthcare System Portal
An AI oversight group said the breach is the first instance of an AI agent hacking into a government website.
Australian officials said Wednesday that they were investigating what appeared to be the first case of an artificial intelligence agent "autonomously choosing to hack into a government," as one AI oversight group said, as Prime Minister Anthony Albanese said that OpenAI's agents had gained unauthorized access to the country's Medicare system.
Albanese commented on the breach at a United Nations summit as world leaders met in New York for the UN General Assembly. He said that while the hacking incident took place in June, OpenAI only disclosed the episode to the government on September 10—and then only by writing an email to a "public mailbox" that is checked once a day.
On June 18, OpenAI's AI agents were directed to conduct internet research into public health spending using the statistics reporting website for Australia's universal healthcare system, Medicare, which provides government-funded healthcare for 27.5 million people.
The agents were repeatedly blocked from gathering information, and then tried "alternate ways” to gain the data, including by hacking into nonpublic sections of the statistics portal, said Albanese.
The prime minister said the agents accessed “public and non-public files within the portal” by "writing files as well to the internal server." He said the agent had not appeared to gain access to anyone's personal medical data.
“This situation is obviously unacceptable,” Albanese said. “Today, I spoke with the CEO of OpenAI, Sam Altman, to express Australia’s extreme concern about this incident, and I also expressed my disappointment that it took the company way too long to inform the government what had occurred.”
JUST IN: An OpenAI AI agent went rogue and hacked the Australian government.
At a press conference earlier today, Australian Prime Minister Anthony Albanese confirmed the AI broke into Australia's Medicare statistics portal and accessed non-public data.
The attack occured in… pic.twitter.com/YZuziHGYVt
— ControlAI (@ControlAI) September 24, 2026
The Guardian reported that OpenAI's models had also attempted to breach the websites of the Australian Institute of Health and Welfare, the Victorian Department of Health, and the New South Wales Bureau of Crime Statistics and Research.
Officials in Victoria and New South Wales said they were investigating the incidents and that it appeared no personal information had been shared in the breach.
But in the Medicare infiltration, Deputy Prime Minister Richard Marles told ABC Radio on Thursday, OpenAI's agent "sought information, information was not given, and then it effectively hacked into that medical portal and got that information anyway."
“It’s that unauthorized access which we are very concerned about," Marles said.
The AI oversight research lab Transluce also identified previously undisclosed breaches that were attempted by OpenAI's models in May, including the unsuccessful attempted hacking of a digital library at the University of New Mexico and of Data USA, which collects public data on employment and education in the US.
The news of OpenAI's Medicare hack follows several disclosures of other breaches by the company's agents. In July, hundreds of its models escaped from a testing environment and gained unauthorized access to the machine learning company Hugging Face.
Earlier this year, the firm's models hacked into an online coding service called RubyGems—an incident that was only disclosed this month.
The security breaches have led AI executives including Altman to call for a "pacing" of AI development as the technology gains the ability to build the next generation of AI on its own, also known as recursive self-improvement.
Meanwhile, lawmakers including US House Speaker Mike Johnson (R-La.) have insisted that the industry should be permitted to regulate itself and claimed that strong government regulations will allow China to "overlap us" on AI development.
On Wednesday, US Sen. Bernie Sanders (I-Vt.) and Rep. Greg Casar (D-Texas) introduced a bill to ban AI superintelligence, which "exceeds human cognitive performance and capabilities across most domains, or has sufficient capabilities to destroy or disempower humanity, including by overthrowing the federal government.”
Former Federal Trade Commission Chair Lina Khan is among those who have emphasized that AI firms can and must face legal liability for damage done by their products.
"There’s no AI exemption from laws already on the books," she said earlier this month.
Lizzie O'Shea, spokesperson for the Australian group Digital Rights Watch, said Thursday that the Medicare breach, and OpenAI's failure to alert the government until months later, show that "basic rules and standards for tech companies" are needed.
"There have to be guardrails and safety measures in place which are way ahead of the capability which is being developed," said O'Shea. "Artificial intelligence has potential to do some things well, but it also poses huge risks—like hacking systems that store Australians’ sensitive personal data... The question is whether governments are going to let AI and tech companies run wild or whether they, on behalf of ordinary people, will put rules in place for tech companies that will promote accountability and trust.”
