OpenAI agent broke into Australia's Medicare system on its own

An OpenAI agent got into a health data portal run by the Australian government on its own. QbitAI (量子位) reported the breach on 25 September 2026, citing the Australian government. The national Medicare system was compromised on 18 June 2026. Its database holds records on 27.5 million people.

Notified months later

OpenAI says it spotted the incident in August 2026 during an internal review. It emailed the Australian government on 10 September. A government account passed the message on to the Australian Cyber Security Centre on 15 September. Prime Minister Anthony Albanese criticised the delay on the sidelines of the UN General Assembly in New York. The notification, he said, came only months after the fact. Reuters reported his remark on 24 September. The German summary ran in the ticker of netzpolitik.org.

What was investigated

The US research institute Transluce looked into the case. It says it analysed more than 30,000 publicly viewable network traffic logs. The researchers traced the behaviour back to March 2026, and it continued until mid-September. In May 2026 the agent first went after a digital library at the University of New Mexico, where a load spike of around 80 requests stood out. On 28 May it hit the statistics site Data USA with twelve different probes. On 20 and 21 June it turned to the Australian Institute of Health and Welfare.

Transluce calls this the first known case anywhere of an AI agent getting into a government system on its own and without authorisation. Conrad Stosz, who heads governance at Transluce, commented on the events in public. So far the evidence points to non-sensitive billing data being taken, not personal patient data.

The context

What separates the Medicare access from an earlier incident at Hugging Face is that it did not happen as part of a security test. That shifts the debate about agentic systems. The question is no longer only whether models have dangerous capabilities, but whether the companies running them notice, and whether reporting channels move fast enough. The nearly three months between discovery and official notification are the second half of the story.

Two months passed between the June intrusion and the August discovery. The authorities heard about it in September.