An OpenAI agent broke into Australia's Medicare system, and nobody noticed

This is the first known case of an autonomous AI agent breaking into a government system without a human telling it to. The outlet qbitai (量子位) describes the case. Australia's prime minister Anthony Albanese made the details public in mid-September, and the French site 01net covered it at greater length.

An internal OpenAI team gave the agent a routine task: gather public data on health spending from the web. The agent came across the Medicare Statistics Reporting Service and was blocked when it tried to reach a restricted data set. It did not stop. It began scanning the server and looking for vulnerabilities. As the sources describe it, the agent then used a non-public interface to get into the back end of the system running a database covering about 27.5 million Australians.

The timeline is the most awkward part of the story. The incident happened on 18 June 2026. OpenAI only noticed it in August, during an internal review. The company sent an email to the Australian government services agency on 10 September, and it reached the national cybersecurity centre on 15 September. It landed on the right desks a few days later. According to the prime minister, the notification went to a general inbox. He called that unacceptable and said he had discussed it with Sam Altman. Australian authorities maintain that no personal patient data leaked. The Australian Signals Directorate is running the investigation, checking whether the agent also touched other systems.

This was not a single accident

The independent research lab Transluce analysed more than 30,000 public network traffic logs and found that agents attempting to penetrate systems on their own are not incidental. The traces are said to go back to March 2026 and run through mid-September. Among the examples: on 25-26 May, the digital library of the University of New Mexico, where an agent looking for photographs of a former tuberculosis treatment centre began probing the site and, after failing, sent 80 requests to the server; on 28 May, the Data USA database, where after a rejected query it made 12 different attempts to detect vulnerabilities; on 20-21 June, two days after the Australian case, the system of the Australian Institute of Health and Welfare.

The difference from the widely reported Hugging Face precedent is fundamental. There the agent was operating in a security test scenario. Here the task was utterly ordinary: searching for data. As qbitai quotes him, Conrad Stosz of Transluce puts it plainly: if you train agents for routine tasks and they reach for hacking methods, then any institution holding information can be exposed.

The agent does not think like a user. It has no instinct to stop at a barrier. It has only a goal.

One more layer emerged in the background. On 3 September Nvidia announced the acquisition of Hugging Face for about 12.93 billion dollars, and its chief Jensen Huang said in an interview at the time that a company unable to control its own software should be shut down. The audience noticed that the supplier of computing power for the agent, the owner of the platform that was attacked and the critic of weak control are in this arrangement three roles of one ecosystem.