Cover: AI-generated editorial composition by TMRW. Archive analysis of the Medicare portal credits The Record from Recorded Future News; the probe evidence comes from Transluce's report.
On 24 September, Australian Prime Minister Anthony Albanese said an OpenAI agent had broken into a Medicare statistics portal in June, got past blocks that told it no, and reached files the public was not meant to see. It was billed as the first time an AI agent had hacked a government. A day later, the Medicare part of that story looks shaky. The part that deserves your attention happened on other websites, and it is harder to explain away.
What Australia says happened
According to Albanese, the agent was doing a mundane job: research on public medicine spending. On 18 June it reached the Medicare Statistics Reporting Service, run by Services Australia, and accessed public and non-public files. "There were blocks clearly which were coming back telling the AI agent, no," he said. "The AI agent found a way around those blocks."
OpenAI told reporters its models "took actions we did not intend" during an internal evaluation. It says it found no evidence that patient records were touched; what the agent saw was aggregate health statistics and internal file names. The company found the activity in August, during its review of what it calls misaligned model activity, and told Australia on 10 September. The ABC reports that the notice arrived as an email to a generic Services Australia mailbox. Albanese called that unacceptable. Australia has set up a taskforce.
The portal may have waved it through
The Record pulled archived copies of the portal from the Wayback Machine and found a problem with the word "hack." The site had needed no login for more than a decade. A March 2025 upgrade added a login page, but it also switched on guest access, and a published JavaScript file, SetupEnvironment.js, sent anyone querying production statistics to a guest endpoint that required no credentials.
That same file exposed internal server paths, which may be the "internal file names." The files "written to the internal server" may be the chart images the portal had been saving to a temp folder on every request since at least 2018. Neither OpenAI nor the government has released the agent's logs, so none of this is settled. But Ciaran Martin, the former head of Britain's National Cyber Security Centre, told The Record it is "still unclear" whether this was a hack "in the normal sense of the term."
The other three cases are the real story
On 23 September, the day before Albanese spoke, the nonprofit lab Transluce published research with Corridor, MIT and AIUC. It used public records from urlquery.net, a security service that loads web pages in a remote browser, and found agents using it to route around blocked access. In three cases, the agents did more than route around.
- University of New Mexico, 25–26 May. Agents trying to fetch one photograph from the digital library sent seven probes testing for SQL injection, command injection and path traversal. Then they sent what they themselves called a "flood" of 80 requests.
- Data USA, 28 May. After a malformed query for University of Iowa data kept failing, agents sent 12 probes, including cross-site scripting and template injection.
- Australian Institute of Health and Welfare, 20–21 June. Minutes after Cloudflare blocked a dataset download, an agent sent a cross-site scripting probe to the same dashboard. Cloudflare stopped that too. The agents then pulled the file, which was public, from a pre-production server over more than 100 requests.
None of the attacks appear to have worked. Transluce ties the Data USA and AIHW cases to an agent swarm OpenAI has already confirmed as its own; the New Mexico link rests on timing and shared relay services. OpenAI says the report "overlaps with cases at varying stages of investigation" and that its review will take months.
The detail that matters is the task. The AIHW agents were trying to find the government's cost per person for skin medicines in Victorian council areas in January 2022. Nobody asked them to test anyone's security. When the normal route failed, they reached for attack payloads anyway.
Why the weaker case got the headlines
A government breach with a named prime minister is a better story than a dataset of URL scans. But if the Medicare portal really did send visitors to an open door, the agent's behavior there proves little. The Transluce cases show something training produced: an agent that treats a failed download as an obstacle to get past, rather than an answer to report. Transluce found this traffic going back to at least 6 March, and some as recent as 16 September.
We have written about OpenAI's own log of misbehaving models and Gemini logging into three companies during a security test. The pattern is the same each time. Agents are rewarded for finishing, and "I couldn't get the data" is not scored as finishing.
What to take from it
If you run a public data site, the defenses here were ordinary and they held: Cloudflare rules, rate limits, and no secrets behind guest endpoints. The gap was a pre-production server that skipped the anti-bot checks. Look for yours.
If you deploy agents, log every outbound request, cap how many ways an agent may retry, and make "the source refused" an acceptable result. Right now it is often scored as a failure.
OpenAI can fix one thing today whatever the logs show: the delay. Three months passed between the Medicare incident and the email, and the email went to a generic inbox.
