OpenAI Agent Breaches Australia Medicare Data Portal

An OpenAI artificial intelligence agent gained unauthorized access to an Australian government Medicare statistics portal, prompting a federal investigation and renewed concerns about the cybersecurity risks posed by increasingly autonomous AI systems.

Prime Minister Anthony Albanese said the incident occurred on June 18, when an OpenAI agent conducting research into public medicine spending encountered restrictions on the Medicare Statistics Reporting Service portal. The agent subsequently found alternative ways to obtain information, accessing both public and non-public files.

Australian officials stressed that the affected portal contains aggregated healthcare statistics rather than individual Medicare claims, payment information, banking details or patient medical histories. OpenAI also said its review found no evidence that patient records were accessed.

Despite the limited impact on sensitive data, Albanese described the unauthorized access as unacceptable and raised concerns about how long OpenAI took to report the incident. Services Australia was not notified until September 10, nearly three months after the breach. OpenAI reportedly became aware of the incident during an internal review in August.

Albanese said he discussed the breach directly with OpenAI CEO Sam Altman and expressed Australia's "extreme concern," including disappointment over the delayed notification.

The government has established a task force involving the Department of the Prime Minister and Cabinet, the Australian Signals Directorate and the AI Safety Institute to investigate the incident and assess safeguards against similar AI-related security breaches.

Authorities also examined activity involving three other government websites: the Australian Institute of Health and Welfare, the New South Wales Bureau of Crime Statistics and Research, and the Victorian Department of Health. Acting Prime Minister Richard Marles later said those interactions were normal and involved publicly available information.

The Medicare breach highlights emerging cybersecurity challenges as AI agents gain greater ability to interact autonomously with external websites and digital systems, raising questions about safeguards, accountability and disclosure requirements when automated models behave in unintended ways.