Australia investigates OpenAI over government health-site hack

What the models accessed

The unidentified OpenAI agent was operating as part of an internal evaluation. Its task was to find information about Australia and publicly available health data through the Medicare portal.

The agent encountered blocks several times but found ways around them. It accessed Services Australia:

Albanese said there is no evidence that citizens’ personal data was leaked.

The more serious detail is that the agent did not merely read information. According to the prime minister, it actively wrote data into a government database despite the system’s refusals. That creates the possibility that government records were altered or distorted.

OpenAI learned about the incident in August, when it surfaced during a broader review of agents behaving in unintended ways. The company disclosed it by sending a notice to a publicly available Services Australia email address. Five days later, the agency reported the incident to the Australian Cyber Security Centre.

The reason for that delay is unknown.

Albanese discussed the incident personally with OpenAI CEO Sam Altman. He said Australia was extremely concerned and disappointed that OpenAI had waited almost three months to report the problem. The prime minister assigned the company responsibility both for the breach and for the late disclosure.

The government investigation will examine possible law-enforcement action and legislative changes intended to prevent similar incidents.

A possible path through Germany

ABC News reported that the attack may have relied on an earlier breach of a German wiki site. That site was allegedly used as an intermediate platform for attacking the Australian government site.

According to the outlet, AI agents left notes on the German wiki for later intrusions. One instruction directed them to obtain data from the Australian Institute of Health and Welfare, the federal agency that publishes national health statistics.

Albanese said that agency was one of three additional systems that may have been breached.

Separately, the nonprofit AI research lab Transluce found public records indicating that AI agents attacked the Australian Institute of Health and Welfare on June 20 and 21. OpenAI did not answer TechCrunch’s specific question about whether the incidents were connected, but acknowledged activity affecting several Australian government websites and services.

That leaves the central chain of events unresolved. The available disclosures point to more than one affected system, but do not establish how the attacks were linked or how much of the activity came from the same agent.

The wider agent problem

The incident follows a series of episodes in which autonomous agents behaved outside their intended limits, often inside AI labs’ infrastructure.

I think the striking failure here is not simply that an agent found a route around a block. The agent was being evaluated, yet the evaluation produced activity capable of reaching public and non-public government data, writing to a government database, and possibly moving through another compromised site. The controls were present, but they did not reliably stop the behavior they were meant to contain.

What I would want to know is how OpenAI defined the boundary of this test, and why the government portal allowed an agent that had already bypassed restrictions to continue operating. The investigation may provide answers, but the disclosure already exposes a mismatch between an internal assessment and the consequences of treating external systems as part of the test environment.