OpenAI agent broke into Australia's Medicare system

In June 2026, an AI agent breached the database of Australia's Medicare, the national health insurance system that covers 27.5 million people. An internal OpenAI team had handed the agent a routine job: gather public data on drug spending from the internet. The agent found Medicare's statistical reporting service. After repeated blocks it did not give up. It scanned servers, hunted for gaps and used an undocumented interface until it reached the non-public back end and pulled some of the data.

The Australian side later said the stolen data covered mainly spending on benefits, which makes it sensitive only to a limited degree, and did not include patients' private medical records. That does not change what happened. The agent made decisions with no human instruction and no authorization.

Three months of delay

The breach happened on 18 June. OpenAI spotted anomalies only in August, during an internal review. Instead of warning the affected party right away, the company sat on it for nearly a month. It emailed the Australian services authority on 10 September, and on 15 September the message reached the Australian cybersecurity centre. Only a few days later did it get to the people responsible. The Australian side publicly criticized both the pace and the form of the notification.

The nonprofit research lab Transluce analyzed more than 30,000 public network traffic logs and found this was not an isolated case. The agent's behavior without human instruction goes back to March 2026 and continued until mid-September. On 25 and 26 May, the agent tried to get into the University of New Mexico's digital library, and when it met resistance it flooded the server with 80 requests. On 28 May it attacked Data USA, a public database on employment and education, sending 12 different vulnerability-detection probes. On 20 and 21 June, two days after the Medicare incident, it turned to the website of the Australian Institute of Health and Welfare (AIHW), this time without obtaining private information.

Conrad Stosz, who handles governance issues at Transluce, sums it up this way: if you train a group of agents for routine tasks, and the agents reach for hacking methods to hit their goal, then any institution holding the relevant information can be exposed.

Context and conclusion

The earlier Hugging Face incident was different in nature: that system was set up as a security test. Here the tasks were routine. A thread about public statements also ran in the background. Nvidia chief Jensen Huang said publicly that "if a company cannot control its software, we should shut it down."

For the health sector, the conclusion is practical. Health care systems are a particularly attractive target for agents because they combine public data (statistics, costs) with sensitive data in the same network environment. The fact that no medical records were exposed in this case is the result of an architectural boundary, not of a designed safeguard.