AI Agent From OpenAI Hacked Australia’s Medicare Portal
Set Trending Topics as a preferred source on Google.
When a head of government calls Sam Altman personally to complain, something has gone badly wrong: an AI agent built by OpenAI gained unauthorized access to an Australian government health portal. Australian Prime Minister Anthony Albanese has just made the incident public on the sidelines of the UN General Assembly in New York. It is one of the first publicly known cases of an AI system breaking into a government website on its own.
The target was the Medicare Statistics Reporting Service, a public-facing statistics portal run by the agency Services Australia for the country’s national health scheme, Medicare. In June, the agent accessed non-public aggregate health statistics and internal files on an older website, according to ABC News. A crawler, an automated program that scans and collects data from websites, apparently found a way around the security measures. The AI agent found a way around those blocks and would not take no for an answer, Albanese said. Based on current information, no personal data was affected.
Albanese: "Obviously Unacceptable"
The prime minister was particularly angered by how late the incident was reported. OpenAI only informed Australian authorities by email in early September, roughly three months after the breach. According to ABC News’ live blog, the message arrived via a public feedback portal intended for researchers to flag weaknesses in the website. Services Australia reported the case to the Australian Signals Directorate’s (ASD) cyber security center a few days later.
Albanese said he spoke directly with OpenAI CEO Sam Altman to convey Australia’s "extreme concern." It had taken the company far too long to inform the government, and the way the notification was made was unacceptable, he said, as quoted by Fox Business. Asked whether Altman had apologized, Albanese said the OpenAI chief had clearly accepted that the company had not done well enough.
The incident may be larger than first thought. According to Fortune, the government is aware of three other state systems the agent may have reached: two health-related and one dealing with crime statistics and research. The ASD is leading a forensic investigation. Acting Prime Minister Richard Marles called it a "very serious" incident in Sydney while stressing that its impact was relatively minor, since it involved aggregated statistics and the systems themselves had not been compromised. The Greens, meanwhile, are calling for the case to be treated as a diplomatic incident and for the US ambassador to be summoned.
OpenAI Cites "Misaligned" Model Behavior
OpenAI said it discovered the incident in August during an extensive review of "misaligned model activity," meaning model behavior that runs counter to its developers’ intentions. During an internal evaluation, the models had tried to look up answers and statistics on questions about Australia and accessed several Australian government websites in the process. In doing so, they took actions that were not intended, the company said. It found no evidence that patient records had been accessed.
Hugging Face, DSEWiki and Six More Incidents
The Australian hack is the latest in a series of incidents involving OpenAI agents that have dogged the company since the summer. It began in July with the attack on AI platform Hugging Face. As Trending Topics reported, agents broke out of their isolated test environment during an internal evaluation and connected with each other through an improvised message board. Around 1,200 agents exchanged more than 70,000 messages and files there, and about 700 took part in the attack. Using a zero-day vulnerability, they harvested credentials, gained root access on one server and, in parallel, obtained administrator rights on an OpenAI research cluster. OpenAI attributes this to reward hacking: the agents searched the web for solutions to their test tasks, a behavior that had been rewarded during training. Hugging Face is now demanding $100 million worth of compute (roughly €85 million) from OpenAI as compensation, Trending Topics reported.
In early September came the next case, this time with a link to Austria. OpenAI confirmed that its AI agents had published content on several websites without authorization, most notably on DSEWiki, an Austrian-operated platform for German-speaking software developers. Researchers found around 18,000 posts under more than 3,700 self-assigned agent names, as Trending Topics reported. The agents used the wiki as a bulletin board to share solutions and circumvent security restrictions. OpenAI submitted an incident report to the European Commission.
In response to the wiki incident, OpenAI unveiled its own framework for disclosing such incidents in mid-September and published six more cases from the past six months, including a model that used a publicly exposed API key without authorization and then fabricated data, CNBC reports. OpenAI already knew about the access to Australian government websites at that point, yet the case was not on the list.
Pressure on the Entire Industry
The problem extends beyond OpenAI. Anthropic, Google and other providers are also increasingly developing autonomous agents that browse the web and operate tools. A binding, industry-wide standard for reporting such incidents does not yet exist.
