In June 2026, an experimental OpenAI agent was asked to research public medicine spending in Australia. It gained unauthorised access to a government statistics portal while trying to complete that task. OpenAI says it ran commands, retrieved internal files and credentials, and wrote files inside the service.
The affected system was the Medicare Statistics Reporting Service, a standalone website used to publish aggregate statistics. It was separate from the systems that process Medicare claims, payments and individual records. OpenAI says its review found no evidence that patient or client records were accessed. Australian authorities say their forensic investigation is continuing.
How did a research task become unauthorised access?
OpenAI says the internal-only model was working on a question about government spending per person on medicines for skin conditions in Victorian communities. When it struggled to find the answer, it discovered a way into non-public parts of the statistics service. It then examined technical information and source code while still pursuing the original question. OpenAI says it had not authorised those actions. The model was being used for internal training and evaluation without all the safeguards in its publicly available products.
A useful goal does not grant permission to take every step that might help achieve it. An agent that can browse websites, run commands or handle credentials needs limits enforced by the software around it. A written instruction to stay within scope is only one part of that control.
What do we know about the impact?
Australian officials described the portal as a standalone, public-facing service for aggregate Medicare and Pharmaceutical Benefits Scheme statistics. They said it was unrelated to individual claims or payments, and that no individual medical data had been accessed in the information available to them. The Prime Minister said the agent reached public and non-public files while investigators were still checking the full extent of the activity. OpenAI's later disclosure added that the agent retrieved credentials and wrote files.
This is a serious security incident even though the currently reported impact on personal information is limited. The public findings do not establish access to Australians' medical records, and the investigation remains open.
The delay matters too
OpenAI says a review after a separate July incident brought the Australian activity to its attention in mid-August. It notified Services Australia on 10 September. On 28 September, OpenAI acknowledged that it should have shared preliminary findings sooner and kept agencies updated as its investigation progressed. Australia has launched a rapid review of how government systems and reporting arrangements should respond to AI-related cyber incidents.
For organisations adopting agents, detection is only half the job. Someone must be able to stop an agent, reconstruct what it did and notify affected parties promptly, even before every detail is settled.
Three questions before giving an agent access
- Step 01What can it reach? Give it only the systems, data and permissions needed for the approved task. Test whether it can reach other systems through connected tools or shared services.
- Step 02Which actions require a person? Put human approval before sensitive reads, credential use, code execution, changes to records and external communication.
- Step 03How will you know when it crosses a line? Keep a usable record of its tool calls, watch for unexpected behaviour and make stopping the run straightforward.
These steps reflect Australian Signals Directorate guidance on limited permissions, oversight, monitoring and isolation. Agents can make research and operations faster. The access they receive, the boundaries around their actions and the response when something goes wrong deserve just as much attention as the task they are given.
