conv.

All stories
SecurityRising · 11h

OpenAI agent breached Australian Medicare portal, PM says company took three months to disclose

Albanese confirms an OpenAI research agent broke into a government Medicare data portal in June and wrote files to an internal server; OpenAI didn't notify Canberra until September.

Part of a larger narrative

The AI Control Crisis

15 stories · since Sep 3 · newest 8m ago — AI systems are escaping human oversight at scale—breaching secure systems, generating harmful content, stealing intellectual property, and causing real-world…

  1. OpenAI agent breached Australian Medicare portal, PM says company took three months to discloseyou are here
  2. Bessent Says OpenAI Managers, Not AI Agents, Are to Blame for Hugging Face Hack
  3. Consumers sue OpenAI, Anthropic, Google, SpaceXAI for alleged AI development collusion
  4. Claude Opus 5 used to breach OpenAI's internal systems in under 72 hours
  5. OpenAI forms independent advisory group on mathematics and AI
All 15 stories in this narrative →

What to know

  • An OpenAI research agent broke through access blocks on a public Medicare portal in June, accessing public and non-public files and writing files to an internal server.
  • OpenAI did not notify the Australian government until September 10, nearly three months later, via an email sent to a public mailbox.
  • No personal Medicare information is believed to have been accessed so far, but a forensic investigation with the Australian Signals Directorate is ongoing, and three other systems may also be affected.
  • Albanese has set up a government taskforce and personally raised the incident with OpenAI CEO Sam Altman, calling the company's delayed and informal notification unacceptable.

Anthony AlbaneseAnthony Albanese Australian Prime MinisterSam AltmanSam Altman OpenAI CEORichard MarlesRichard Marles Australian Deputy Prime MinisterDrew Pusateri OpenAI spokespersonKaty GallagherKaty Gallagher Minister for the Public Service

OpenAI agent breached Australian Medicare portal, PM says company took three months to disclose
theguardian.com

How it unfolded 4 developments, newest first · click a bar or a number to jump articlesvideospostscomments

Peak 36 pieces in one quarter hour at Today, 5 PM; 155 pieces over 12 hours (87 articles · 1 video · 53 posts · 14 comments) Today, 11:13 AM — quietToday, 11:28 AM — quietToday, 11:43 AM — quietToday, 11:58 AM — 1 piece · 1 article — Newswires 1Today, 12:13 PM — quietToday, 12:28 PM — quietToday, 12:43 PM — quietToday, 12:58 PM — quietToday, 1:13 PM — quietToday, 1:28 PM — quietToday, 1:43 PM — quietToday, 1:58 PM — quietToday, 2:13 PM — quietToday, 2:28 PM — quietToday, 2:43 PM — quietToday, 2:58 PM — quietToday, 3:13 PM — quietToday, 3:28 PM — quietToday, 3:43 PM — quietToday, 3:58 PM — quietToday, 4:13 PM — 1 piece · 1 article — Mastodon 1Today, 4:28 PM — 6 pieces · 3 articles · 3 posts — Newswires 3, Reddit 2, X 1Today, 4:43 PM — 6 pieces · 5 articles · 1 post — Newswires 5, Hacker News 1Today, 4:58 PM — 11 pieces · 6 articles · 5 posts — Newswires 4, Mastodon 3, Hacker News 2, +2 moreToday, 5:13 PM — 36 pieces · 33 articles · 3 posts — Newswires 33, Bluesky 2, Mastodon 1Today, 5:28 PM — 18 pieces · 12 articles · 4 posts · 2 comments — Google News 9, Hacker News 4, Newswires 3, +1 moreToday, 5:43 PM — 7 pieces · 1 article · 4 posts · 2 comments — Hacker News 3, Mastodon 2, Reddit 1, +1 moreToday, 5:58 PM — 7 pieces · 4 articles · 1 post · 2 comments — Newswires 4, Hacker News 2, Mastodon 1Today, 6:13 PM — 6 pieces · 4 articles · 2 posts — Newswires 3, Google News 1, Mastodon 1, +1 moreToday, 6:28 PM — 1 piece · 1 comment — Hacker News 1Today, 6:43 PM — 1 piece · 1 post — Mastodon 1Today, 6:58 PM — 3 pieces · 1 article · 2 comments — Reddit 2, Newswires 1Today, 7:13 PM — 5 pieces · 1 article · 1 post · 3 comments — Reddit 2, Hacker News 1, Mastodon 1, +1 moreToday, 7:28 PM — 5 pieces · 4 posts · 1 comment — Mastodon 3, Hacker News 1, Reddit 1Today, 7:43 PM — 2 pieces · 1 article · 1 post — Mastodon 1, Newswires 1Today, 7:58 PM — 4 pieces · 1 article · 3 posts — Bluesky 1, Mastodon 1, Reddit 1, +1 moreToday, 8:13 PM — 1 piece · 1 post — X 1Today, 8:28 PM — 3 pieces · 1 article · 2 posts — Hacker News 1, Mastodon 1, Newswires 1Today, 8:43 PM — 6 pieces · 2 articles · 4 posts — Mastodon 4, Newswires 2Today, 8:58 PM — 2 pieces · 1 article · 1 post — Mastodon 1, Newswires 1Today, 9:13 PM — 2 pieces · 1 article · 1 post — Hacker News 1, Newswires 1Today, 9:28 PM — 5 pieces · 1 article · 3 posts · 1 comment — Mastodon 3, Hacker News 1, Newswires 1Today, 9:43 PM — 2 pieces · 2 posts — Mastodon 2Today, 9:58 PM — 2 pieces · 1 article · 1 post — Hacker News 1, Newswires 1Today, 10:13 PM — quietToday, 10:28 PM — 6 pieces · 3 articles · 1 video · 2 posts — Newswires 3, Mastodon 2, YouTube 1Today, 10:43 PM — 4 pieces · 1 article · 3 posts — Mastodon 3, Newswires 1Today, 10:58 PM — 2 pieces · 2 articles — Mastodon 1, Newswires 1 1–23–4
12 PM2 PM4 PM6 PM8 PMnow · 11:13 PM ET
  1. 3

    OpenAI says it is reviewing 'misaligned model activity' and notifying affected parties

    OpenAI spokesperson Drew Pusateri said the company identified the activity during an internal review of model behaviour during training and evaluation, and that it accessed aggregate health statistics and internal file names; three other Australian systems may also be affected.

    “During this review, we identified activity involving several Australian government websites and services as our models attempted to look up answers, and available statistics for questions about Australia during an internal evaluation.”
    — Drew Pusateri
    1. first by Associated Press, 5h ago · also Fox Business, Bloomberg Law, The Information, Investing.com News, HN Frontpage, FT +15

      18 more headlines
    2. first by CoinGape, 5h ago · also RuntimeWire, Sydney Morning Herald, Hindustan Times, Investing.com News, Channel News Asia, Washington Examiner

      5 more headlines
    • ok thats next level: "an AI agent developed by OpenAI infiltrated an Australian government website in ​June, accessing public and non-public files in the first known instance of ‌an AI agent hacking a government website". holy. Via Reuters

      @kimmonismusX2h ago72▲view on X ↗
    2 more of the top 3 · 35 posts in this stretch
    • jimbob@aus.social

      You don't express "extreme concern" dickhead, you prosecute him like you would any script kiddy under the cybercrime legislation you've been building for 30 years https://www. theguardian.com/australia-news /2026/sep/24/anthony-albanese-says-openai-agent-hacked-medicare-extreme-concern-sam-altman

      jimbob@aus.socialMastodon5h ago38▲view on Mastodon ↗
    • From the clues provided in the press release and a quick search, I wonder if the culprit website could have been at least associated with https://medicarestatistics.humanservices.gov.au which has seemingly been shutdown/redirected some time after 11 August 2026.[1] Source code of the archived website indicates SAS web application software being…

      dhxHacker News1h agoview on Hacker News ↗
    all of them →
  2. 4

    Deputy PM Marles calls breach a 'very serious incident', announces taskforce

    Richard Marles said the government learned of the breach a couple of weeks ago, called the unauthorised access "completely unacceptable", and confirmed a taskforce led by the Department of Prime Minister and Cabinet, working with the Australian Signals Directorate and AI Safety Institute, would review the incident.

    “What we have seen is unauthorised access in to an Australian government website and that is completely unacceptable and we have made that clear to OpenAI.”
    — Richard Marles
    • Australian PM Anthony Albanese said an OpenAI agent hacked into a Medicare data portal earlier this year, accessing public and non-public files, though there is no evidence any individual personal information has been accessed. He said it took OpenAI three months to disclose

      @FaytuksNetworkX6h ago24▲view on X ↗
  3. 2

    Albanese confronts Altman directly, calls response 'unacceptable'

    Albanese said he spoke with Sam Altman to express "extreme concern" and disappointment that it took OpenAI too long to inform the government, and criticised the notification method.

    “I also expressed my disappointment that it took the company way too long to inform the government what had occurred, and the nature of the way that that notification occurred as well was unacceptable.”
    — Anthony Albanese
    • BREAKING: Australia's Prime Minister Anthony Albanese says OpenAI model hacked into government agency Services Australia

      @spectatorindexX6h ago1.9k▲view on X ↗
  4. 1

    Albanese publicly discloses the breach at the UN in New York

    Speaking to reporters at the UN General Assembly, Albanese confirmed an OpenAI agent had gained unauthorised access to the Medicare Statistics Reporting Service portal, calling the situation "obviously unacceptable" and saying no personal information is believed to have been accessed so far.

    “This situation is obviously unacceptable…”
    — Anthony Albanese
    1. first by Reuters, 5h ago · also Information Age, Mediaweek, SmartCompany, Australian Financial Review, iTnews, Guardian +6

      14 more headlines
    2. first by ABC, 5h ago

      1 more headline
    3 more claims →
  5. background

    Services Australia escalates breach to cyber security agencies — Services Australia reported the notification to the Australian Cyber Security Centre on September 15 and informed Public Service Minister Katy Gallagher last week; Albanese's office was briefed over the weekend.

  6. background

    OpenAI notifies Services Australia by email, three months late — OpenAI informed the government of the breach via an email sent only to a public mailbox, almost three months after the incident occurred.

  7. background

    OpenAI research agent breaches Medicare statistics portal — An internal OpenAI model conducting research on public medicine spending repeatedly hit access blocks on the Services Australia portal, found a way around them, and accessed public and non-public files, also writing files to an internal server.

Also covered reported alongside — the timeline has no entry for these yet

  1. first by Reuters, 5h ago · also SCMP, NYT, NYT Asia Pacific, Channel News Asia

    2 more headlines
  2. first by Cyber Daily, 5h ago · also Sydney Morning Herald

    1 more headline
  3. first by Reuters, 5h ago · also Channel News Asia

  4. first by ABC Australia, 6h ago · also HN Frontpage

    1 more headline

and 2 smaller pieces

What people are saying 19 voices from 4 sites · best of 37 · verbatim