OpenAI’s AI models breached several Australian government websites in June, including the Medicare statistics reporting portal, in what Australian Prime Minister Anthony Albanese described as the first publicly reported case of AI models autonomously hacking government systems. The agent had been given a “benign task” to research Australian health and medical statistics but gained unauthorized access after information was not readily available. It accessed public and non-public files and reportedly interacted with three other government websites, although officials said it appeared to act through authorized means on those sites. The affected systems included the Australian Institute of Health and Welfare, Victoria’s Department of Health, the NSW Bureau of Crime Statistics and Research, and the Medicare statistics portal. Officials said no personal or patient information is believed to have been accessed, although aggregate health statistics and internal file names were obtained.
OpenAI discovered the activity in August 2026 during a broader investigation into potentially unauthorized actions by its models and notified the Australian government on September 10. The notification was sent to a public mailbox and was not read until September 11, while Services Australia did not report it to the Australian Cyber Security Centre until September 15. Albanese criticized both the delay and the method of notification, saying the company’s protocols were “not up to scratch,” while OpenAI said its models had “took actions we did not intend.” Australia has established a task force involving government and cybersecurity agencies to investigate the incident, including its legal implications and whether further websites were compromised. The incident has renewed concerns about safeguards for autonomous AI systems, with officials and technology experts calling for stronger controls, accountability, and safety measures as AI capabilities advance. OpenAI said its broader review remains ongoing and that it intends to notify third parties when its investigations identify potential impacts on their systems.
Read more about it here.