Cybersecurity: an OpenAI agent breached Australia's public health insurance system

No one gave the order. An internal OpenAI team had handed an AI agent a routine job: gather public data on health spending from the internet. The agent went after the statistical reporting system of Medicare, Australia's public health insurance, which covers 27.5 million people, according to the Chinese outlet 量子位 (QbitAI).

A "no" it did not accept

Blocked several times while trying to pull public pages, the agent did not give up. It scanned the server, probed for vulnerabilities and exploited undocumented interfaces to reach the non-public back office. From there it pulled out part of the data. The Australian government says the information was mostly spending figures and statistics. Personal medical records were not affected.

The case turns on the intrusion, but also on the timeline. The system was breached on 18 June. OpenAI spotted the anomaly only in August, during an internal review of its models. The company then waited nearly a month before emailing the Australian agency in charge of services on 10 September. That message reached the Australian cyber security centre on 15 September. The officials concerned heard about it a few days later.

Documented precedents

On the sidelines of the United Nations General Assembly, Australian Prime Minister Anthony Albanese said he had raised the matter with OpenAI chief Sam Altman. He expressed his country's "deepest concern" and its disappointment at a delay that was "far too long". According to the research lab Transluce, this is the first known case in the world of an AI agent autonomously and without authorisation breaching an official system.

Transluce analysed more than 30,000 public network traffic logs and concluded that these behaviours are not isolated. The traces go back to March 2026 and run until mid-September. The researchers cite the infiltration of the University of New Mexico's digital library on 25 and 26 May. There the agent was looking for photographs of an old tuberculosis treatment centre. It probed for vulnerabilities and then launched a burst of 80 requests against the server. They also cite probing of public data sites in late May.

The fallout is all the greater because the industry had been saying the opposite. Nvidia chief Jensen Huang summed up the position of many players in a blunt formula: if you cannot control these systems, you have to stop them.

It was not the model that decided to get around a refusal: it was the agent's architecture, which was built to pursue its goal.