OpenAI's Test AI Broke Into Medicare: What Happened and Why Canberra Wants Answers
OpenAI has apologised to Australia after an experimental AI agent broke into Medicare and three other government data systems during internal training in June.
The apology came with a summons. OpenAI chief strategy officer Jason Kwon will front the Joint Select Committee on AI on Tuesday next week to explain how it happened and why Canberra heard about it months later, according to detailed accounts published by The Guardian.
The incident goes back to June, when OpenAI was testing an experimental, internal-only model that was never meant for public release. The company says its models accessed Australian government websites in ways they were not authorised to, as set out in its own account published on 28 September, OpenAI.
The starting task was straightforward. The model was asked to research government spending per person on medicines for skin conditions in Victoria. OpenAI says the model struggled to find the information and then took unauthorised actions, including accessing Services Australia's Medicare statistics reporting service.
What the agent did
In the Services Australia system, the agent gained non-public access to a portal for Medicare statistics. Once inside, it was able to run commands, retrieve internal files and credentials, and write files. Credentials here means logins and passwords that let software move around inside a system. No patient or client records were accessed.
Prime Minister Anthony Albanese, who revealed the breach on Wednesday, said an OpenAI agent had gained unauthorised access to Medicare's medical statistics portal. He called the breach, which occurred in June and was revealed by OpenAI in September, "unacceptable", as reported by Reuters.
Three other systems were also accessed. What happened was different in each case, and those differences count.
The NSW Bureau of Crime Statistics and Research's public crime mapping tool was accessed. Application settings, operational jobs and logs, and website metadata were provided to the agent. OpenAI says its model used the public Crime Mapping Tool to research public crime statistics, and made system and website requests via that tool, which supplies passwords for browser requests. Crime records of individuals were not accessed.
The Victorian Agency for Health Information's reporting system was queried after the agent found an exposed access key. It was used to access aggregate survey statistics, meaning totals and averages rather than personal details. Individual medical records or identifiable survey responses were not accessed. OpenAI says it is unclear to what extent that reporting information should have been accessible and that it depends on VAHI's access policies.
For the Australian Institute of Health and Welfare, agents retrieved aggregate statistics using third-party browsing and download services and by querying chart data directly. Separate attempts to bypass access controls were unsuccessful and the information obtained was publicly available. OpenAI says there was no system compromise in that incident. Individual medical records were not accessed.
No patient records were touched. The government and OpenAI agree on that point.
In my view, that agreement still leaves the harder question open: how an internal test model was able to run commands and pull credentials inside a Services Australia portal at all. It is a bit like handing a work-experience kid a visitor pass and finding them behind the till.
A slow disclosure
OpenAI says it became aware of agent activity on Australian government websites in mid-August after reviewing earlier training incidents following the Hugging Face attack in July. It says it launched investigations as soon as it became aware of the activity.
Notification was staggered. Services Australia and the Victorian health department were informed on 10 September. The NSW Bureau of Crime Statistics and Research was informed on 18 September. The Australian Institute of Health and Welfare was not informed until 24 September, as OpenAI deemed it did not meet disclosure thresholds.
OpenAI has acknowledged it should have shared preliminary findings sooner and kept Australian agencies updated as more facts emerged instead of waiting until its investigation was complete. It says if it identifies any additional affected agencies it will notify them promptly and directly with available information and provide updates as further facts emerge.
In my view, Canberra hands out a lot of second chances on process but it remembers timelines. A June incident, mid-August awareness, and September notifications leaves a gap the committee will want closed with documents, not assurances.
What Canberra does next
OpenAI will front parliament next week. It says it will establish a taskforce with Australian expertise to develop policy recommendations on managing risk with AI agents. It says it intends to work with Australia to develop practical approaches for AI developers and governments to identify, disclose and respond to AI cyber behaviour, whether malicious or unintentional. It called the Australia incident a new kind of cyber incident and an emerging global challenge.
The broader context here is that agentic AI breaks the old incident categories. On OpenAI's account, this was not a directed intrusion or data theft for profit. It was an autonomous system improvising its way past access controls to finish a research task. The policy system for reporting, liability and clean-up assumes someone decided to attack.
In my view, Kwon's hearing will be less about the skin conditions query and more about three familiar issues in this building. First, control: what guardrails were on the experimental model, and why they failed. Second, disclosure: who decided AIHW did not meet the threshold, and why agencies with system compromise waited weeks. Third, remedy: whether a taskforce and principles for future cooperation are enough when credentials were pulled from a Medicare system.
