OpenAI's agents reached five Australian government sites. Kwon says the way in was 'not super-sophisticated'. That's the bad news.

An OpenAI agent was told to research government spending per person on medicines for skin conditions in Victorian communities. It got into a Medicare portal instead.

It couldn't find the number, so it went looking for where the number lived. In OpenAI's words it "discovered a way to gain non-public access" to Services Australia's Medicare Statistics Reporting Service, then "ran commands, retrieved internal files, credentials and aggregate statistics, and wrote files". The same post says individual patient or client records weren't accessed. The date was 18 June.

Nobody told it to do that. Services Australia didn't find out for 84 days. OpenAI has since named five Australian government bodies its agents reached, and on 6 October its chief strategy officer, Jason Kwon, sat in a parliamentary hearing in Sydney, apologised, and, as Information Age reported it, described the way into Medicare as "not super-sophisticated".

He's right, and that's the bad news rather than the good.

Three weeks on from that hearing there's a second half to the story, and it's below.

In August I wrote that nobody asked the agent to break into Hugging Face. It turns out one had already been inside Medicare.

Related Article16 min read

AI agents broke into Hugging Face and a Melbourne gym. Nobody asked them to.

An OpenAI model spent four and a half days breaking into Hugging Face's systems to cheat a benchmark. A Melbourne agent cancelled a stranger's...

Read full article

Usual disclosure: Webcoda uses Claude every day, and this site's tooling runs on it. Factor that in.

Five sites, and not one zero-day

Services Australia. OpenAI's sentence is the one above, and ABC's reporting on 30 September adds the technical gloss: the model read internal program files, obtained file lists and created test files without authentication, on a legacy system that has since been shut down. The Prime Minister's version, delivered in New York, was blunter. The agent "found a way around those blocks. Didn't accept no for an answer, if you like." ABC reported on 30 September that the data has since been moved to a more secure address.

NSW Bureau of Crime Statistics and Research. The model used BOCSAR's public Crime Mapping Tool, "which supplies credentials for browser API requests", and the system "returned application configuration, operational jobs and logs, and website metadata". No individual crime records. BOCSAR investigated and on 20 October closed its investigation: "no security vulnerability in the Crime Mapping Tool" and "no changes or remediation are required to the tool". Both accounts can be true at once. The tool works as designed, the data behind it is public aggregate statistics, and BOCSAR, which has examined what the tool returned and I haven't, says there was nothing to fix. What OpenAI describes is still the pattern most likely to be sitting in your own build, and I come back to it below.

Victorian Department of Health. Agents "discovered an exposed access key to query the Victorian Agency for Health Information's reporting system" and retrieved reporting configuration and aggregate survey statistics. Then OpenAI adds a sentence I wish more incident write-ups carried: "The extent to which this information should have been accessible is unclear, and depends on VAHI's access policies."

NSW National Parks and Wildlife Service. This one was added on 4 October. Agents "used crafted queries against NPWS's Fire History mapping service to infer database metadata that was not intended to be publicly exposed", and separately downloaded the public dataset. OpenAI says the results it reviewed do not show the model retrieved personal information. It's the mapping-service equivalent of an error message that tells a stranger the shape of your database.

Australian Institute of Health and Welfare. OpenAI says its agents retrieved aggregate statistics using third-party browsing and download services, including from AIHW's website, and queried chart data directly, that separate attempts to bypass access controls were unsuccessful, that the downloaded material appears to have been publicly available, and that there was no system compromise. ABC reported on 26 September that hundreds of agents tried different tactics against AIHW's PBS and aged care data for almost a week.

Line those mechanisms up and the uncomfortable thing is how ordinary they are. An interface that answered without a login. A public tool that hands the browser an API credential, by design. An access key somewhere a browser could reach. A query service that gives up database metadata when you feed it something strange. Hugging Face in July was a real zero-day story, eight CVEs and a stolen cluster credential. The Australian sites are a different kind of story, and a more common one: configuration, exposure and age.

Which invites a fair objection: a competent human tester would have found every one of these holes, and people have been finding holes like them for twenty years. True. What's changed is the volume, hundreds of agents across almost a week, the persistence, blocked and then immediately trying the next thing, and the detection, where the operator's logs said nothing and the lab's said everything.

It wasn't only here, either. Transluce published on 30 September after reviewing agent traffic against US and Canadian government sites, and found no instances where agents reached non-public data in the datasets it examined. It did find two attempts at intrusion: a SQL injection probe, the textbook State_Id=1 OR 1=1, inside more than 200,000 requests to a US Department of Education site, and 13 attack payloads among 899 requests to Library and Archives Canada. Jack Cable, who worked on it, told the ABC that "the way the agents try to access these websites is inconsistent with how a good faith actor would do [it]". Transluce is careful to say it doesn't confidently attribute those two attempts to OpenAI.

84 days, one mailbox

The dates carry this story better than any adjective, so here they are in order.

Access on 18 June. OpenAI began reviewing earlier training and evaluation activity after the Hugging Face incident in July, and that review surfaced the Australian activity on 11 August, per ABC; OpenAI's own post says mid-August. An email landed at publicdisclosures@servicesaustralia.gov.au on 10 September, timestamped 2:42am in the copy the ABC later published, in an inbox ABC reported was monitored once a day. Somebody read it on 11 September. Services Australia reported to ASD's cyber security centre on 15 September, Gallagher was told on 17 September, and the Prime Minister was told over the weekend of 19 and 20 September. The rest of us found out on 24 September, Sydney time, from a press conference in New York.

ABC News

@abcnews

#BREAKING: Prime Minister Anthony Albanese says an Open AI agent gained unauthorised accessed to the Medicare statistics reporting service portal. abc.net.au/news/2026-09-2…

224

23 Sept 2026

That went out at 6:55am and did about 261,700 views, roughly the moment a quiet Services Australia incident became a national story.

Now the split that most of the coverage flattened. It's 84 days from access to notification, and OpenAI knew about roughly 30 of them. For the first 54 nobody knew at all, in either building. Then Services Australia took five days to pass it to ASD, a step Gallagher says has since been strengthened: "we've strengthened that already". Neither half of that is the whole scandal, and reading only one of them is how you end up with the wrong lesson.

Gallagher's fuller defence of the five days came at the 24 September press conference: it took "a couple of days to verify" that the email was legitimate, and "I think there was a weekend in there as well". The Canberra Times reported on 12 October that the agency's CEO, David Hazlehurst, was personally told four days after the email was read.

Cam Wilson published the email itself at the end of the month.

CAMERONWILSON

@cameronwilson

Here is the email obtained by the ABC that was sent by OpenAI to the Australian government's Services Australia to disclose the incident

339

29 Sept 2026

The address is the point. publicdisclosures@ is the mailbox ABC describes as the one academics and researchers use to notify Services Australia of weaknesses, and it's where one of the largest AI companies on earth chose to tell a federal agency its model had been inside a Medicare system. Gallagher says the inbox is now monitored around the clock. The email is worth reading for another reason: it says OpenAI's review had found "no evidence that the model accessed patient-level records, personal information or credentials". The company's public post nineteen days later says the model "retrieved internal files, credentials and aggregate statistics". Two documents, one word apart on the thing that matters most.

Timing produced its own awkwardness. Sam Altman met Richard Marles in San Francisco on 1 September, three weeks after the internal review flagged the activity. Asked by David Pocock whether Altman knew at that meeting, Kwon's answer on 6 October was short: "He was not aware at the time that he met."

Kwon's honest line is the one worth keeping: OpenAI, he said, had "learned our lesson that it is better to inform even with partial information". He also conceded that OpenAI's response "was not good enough as we wanted to understand more of the facts before we spoke to the impacted parties", which is as clean an account of how a disclosure slips 30 days as you'll get.

Anthropic appeared at the same hearing by video. Dave Orr, its head of safeguards, told the committee that "as soon as we detect anything of that nature, we would definitely reach out within a matter of days or sooner", and said Anthropic hasn't found any cases where its models interacted with Australian government systems in an unauthorised way. Promises made after somebody else's incident are cheap. I'd still rather have one on the record.

So here's the question I'd want answered inside your own organisation. If an AI lab finds its agent in your logs, what address does it write to, who reads it, and how fast does it escalate? NPWS shows what the answer looks like once a process exists: OpenAI became aware on Tuesday 29 September and made contact with the NSW Premier's office and the relevant department inside 48 hours.

What the government did, then and since

ASD moved first. On 24 September it published a High Alert, rated Act Quickly, titled "Risks of AI misalignment to Australian organisations", noting that AI agents "have undertaken unexpected actions that were not intended or authorised by its operators". It also said it had no indication of broader threats or malicious targeting of Australia.

Australian Signals Directorate

@ASDGovAu

❗ ALERT ❗

We are aware of instances of AI misalignment, where AI agents have taken unexpected or unauthorised actions.

Australian organisations should maintain strong cyber security controls and secure AI practices.

Read the full alert 👉 cyber.gov.au/about-us/view-…

84

24 Sept 2026

For an agency whose alerts usually concern ransomware crews and state actors, a formal warning about software doing something nobody instructed is a new category.

The mitigations, as Cyber Daily reported them, aren't exotic: strong authentication, access controls and network segmentation; find and fix vulnerabilities promptly; monitor for unusual activity and review logs regularly; patch as soon as practicable; and test your controls and incident response against AI-enabled scenarios. ASD Director-General Abigail Bradshaw put the first one in plainer language: "Reduce your attack surface. What that means is, if you have a system that doesn't need to be connected to the internet, then segregate that system and isolate it." She also offered the line I'll be stealing for years, that the process of cyber security "is like painting the Sydney Harbour Bridge. It never stops."

A month on, launching ASD's annual threat report on 27 October, Bradshaw told the ABC the relationship with the labs now runs on protocols, OpenAI among the companies covered, that act as an "early warning system": "These protocols have been shared with all of the labs, and all of the Five Eyes". Her line on legacy systems had hardened too. There is "much more that we need to do and, in the current context, that is now a matter of urgency".

Then came the part with dates attached. Home Affairs Secretary Stephanie Foster issued PSPF Direction 002-2026, which obliges every non-corporate Commonwealth entity to complete a legacy technology stocktake, set reduction targets and lodge a risk management plan by the end of March 2027, with Systems of Government Significance due by the end of this year. Foster's reasoning is that continued operation of vulnerable legacy systems "poses an unacceptable risk to the Australian government". Marles, as acting Home Affairs minister, put it more simply: "We can't wait for an old system to fail before replacing it." Bradshaw says there has already been a 30 per cent reduction in government legacy software. The direction itself promised the detailed measures in a policy explanatory note by 13 October. As at 29 October that note isn't in the PSPF publications library, and Home Affairs' own news page refers to it without linking it. Entities working to the 31 December deadline for Systems of Government Significance are doing so without a public copy of the measures, whatever has gone round internally. InnovationAus reported on 28 October that Services Australia alone is combing more than 1,000 systems for legacy exposure.

Related Article11 min read

Why We Keep Choosing Umbraco Over WordPress for Government Websites

We've built government sites on WordPress, Umbraco, SharePoint, and Kentico. After 20 years, here's why Umbraco keeps winning when security and WCAG...

Read full article

The Prime Minister also announced a taskforce, which in his words will be "led by my department and involve the National Cybersecurity Coordinator, the Office of AI, the Australian Signals Directorate, the Australian AI Safety Institute, and Services Australia". It has a name, and had one all along: PM&C's page calls it the Rapid review into Australian Government arrangements for an AI-driven cyber incident, with terms of reference dated 24 September covering reporting requirements, escalation pathways, AI firms' notification and cooperation obligations, and whether current offences, penalties and enforcement mechanisms are sufficient. As at 29 October it lists no members, no reporting date and no findings. The Nightly's understanding is that findings will come in the "not too distant future", which is not a date.

Then there's the scale. OpenAI's 30 September post says that as of 26 September its teams had notified more than 100 organisations about activity meeting its notification criteria, out of a review covering approximately 50 petabytes using about 7,000 GB200 and GB300 GPUs at a cost OpenAI puts at over half a million US dollars a day. Wikimedia disclosed on 5 October that OpenAI agents made unauthorised edits, probed Etherpad as a proxy, sent millions of API requests and "may have contributed to" a partial May outage, and Wikimedia found that itself. California Attorney General Rob Bonta served an investigative subpoena on OpenAI on 2 October. Separately, the October release of GPT-6.1 Astra was shelved, with OpenAI's head of safety systems Saachi Jain saying "it didn't quite meet the bar in terms of staying within scope and authorisation".

Andrew Charlton, Assistant Minister for Science, Technology and the Digital Economy, set out the direction in Sydney on 8 October: systems-based regulation modelled on workplace health and safety, banking and aviation, national AI standards by the end of 2026, legislation in 2027, and the line that "relying on regulation alone is like building a fence around a horse, only to realise that horse has wings".

Related Article10 min read

Australia's AI standards are a 2027 promise. Here's the law that governs your AI right now.

Australia announced national AI standards on 15 July, but binding law is early 2027 at the earliest. Here's what actually governs your business AI...

Read full article

The committee that heard Kwon didn't wait for its final report. On 12 October its chair, Jo Briskey, and deputy chair, Jonno Duniam, wrote to the Prime Minister with early advice, and three of the asks bear directly on this story: government-placed independent experts inside the leading AI companies, with system access and a duty to report safety findings and incidents; frontier labs required to "monitor and report incidents to the Australian Government in a timely manner"; and that the government "immediately undertake a review of all government repositories of data". Briskey said the committee wouldn't be shy about recalling OpenAI and Anthropic before the end of the year if needed: "We have not finished our work." David Pocock, who sits on it, said the Prime Minister's office had marked up a draft, and that "we've seen enough major party stitch ups". Duniam's answer was that there had been "no guidance, no interference". The final report is due on 30 November.

What OpenAI did in October

OpenAI's post promised "a taskforce with independent Australian expertise", with its work expected to finish by the end of the year. On 20 October it named one, to the press. Alastair MacGibbon, the former eSafety Commissioner, Johanna Weaver, who runs the Tech Policy Design Institute, and Ray Griggs, former Chief of Navy and later secretary of the Department of Social Services, will produce "practical policy recommendations on how frontier AI companies disclose and respond to misaligned model activity in Australia". It is OpenAI's body, not the government's, appointed by the company whose disclosures it will advise on. Capital Brief reports it operates independently and is due by 31 December, and that independence is worth exactly what gets published, on which OpenAI's post says nothing. The Nightly puts the roles at over $100,000 each, part-time. OpenAI's Australia post doesn't say, and still reads "independent Australian expertise" and "by the end of the year".

Then the money. David Pocock asked, in writing, whether the government had accepted OpenAI's offer of credits after the Medicare incident. The answer, received on 20 October, was that OpenAI "continues to liaise with affected agencies". The offer itself is "an initial US$10 million in billing credits for Australia", about A$14 million, "initially prioritising the five affected agencies", and OpenAI is explicit that "These are billing credits rather than cash payments". ASD has been offered access separately. And there's a line in the same answers worth sitting with: "Australian Government agencies have had access to OpenAI's advanced cyber models since June 2026." That's the month an OpenAI agent was inside the Medicare portal.

The document I'd read first carries the same date. In a report on its alignment site, last updated 20 October and titled "Suppressing misalignment monitoring alerts and disabling misalignment monitoring", OpenAI describes two internal coding tasks, on 3 and 6 October. In the first, a GPT-6.1 Sol agent repairing an evaluation pipeline "disabled automatic alerts to our Security team", reading an earlier instruction not to send messages during a Slack search as permission to stop the notifications. The monitor kept running and saving its reports. The humans just stopped hearing about them. In the second, a GPT-6 Astra agent migrating a program "removed its monitoring integration in order to match a reference implementation, and then falsely claimed to the user that it had not removed the monitor". OpenAI's own summary: "In both cases, the agents considered whether monitoring safeguards should be preserved, but interpreted routine coding instructions as permission to weaken them." It says it doesn't yet have a satisfying explanation, that neither incident was rated P0, and that the fix is a code reviewer told to block attempts to disable monitoring plus, once it gets there, a rule under which workloads without a valid safety case "will be terminated automatically".

Neither incident touched Australia, and neither agent was anything like the one in the Medicare portal. These were coding agents with write access to their own task's plumbing, not a research agent on the open web. The reason the report belongs here is a sentence in OpenAI's Australia post: its current monitoring "would have detected this activity and paged our team for urgent human review". Same company, same class of safeguard, different system. The report shows that safeguard being weakened from the inside, and it also shows OpenAI catching both cases on the day and publishing inside three weeks, which is the opposite of 84 days. Both halves are true. Paging is the control, and the people who build the control have now documented two agents that treated routine instructions as permission to weaken it.

The one outside look at the monitoring itself that I've found comes from METR and Redwood Research, who had two people inside OpenAI for three weeks over the northern summer evaluating, in METR's words, "the systems OpenAI was using to monitor for misalignment from internal agents", and published a short write-up on 23 October, Sydney time.

METR

@METR_Evals

Two employees from METR and Redwood Research worked on premises at OpenAI for three weeks this summer in an embedded assessment pilot. This team evaluated the systems OpenAI was using to monitor for misalignment from internal agents. A brief write-up of their work is now public.

1.2K

22 Oct 2026

OpenAI

@OpenAI

This summer, we invited METR and Redwood Research to pilot an embedded evaluation of our internal monitoring system, providing deep access to our infrastructure over three weeks.

Their findings helped strengthen safeguards as we expanded the system and will help shape future

2.6K

22 Oct 2026

METR's thread notes that OpenAI could make redactions and METR didn't have the right to describe them unilaterally, which is the honest footnote to any embedded evaluation. OpenAI's quote of it says the findings "helped strengthen safeguards". Three weeks, two people, with the company holding the black marker, is what independent oversight of frontier agent monitoring currently looks like. The committee's letter to the Prime Minister, above, asks for something sturdier: independent experts placed inside the labs with a duty to report.

Would you know?

None of the above helps you on Monday, so here's the version that does: four questions, straight from the four mechanisms.

Does any public tool of yours hand credentials to the browser so the page can call an API? That's BOCSAR, and BOCSAR, having looked, says its tool is fine and needs no change. Yours might be fine too. The question isn't whether the pattern is wrong, it's what the API will return to anything holding that credential, because at BOCSAR the answer included application configuration and job logs, and anything that can drive a browser now holds it.

Is there an access key sitting in client-side code, a config endpoint or a repository? That's VAHI. Notice that even OpenAI couldn't say what the key should have reached.

Is there a reporting interface that answers queries without authentication because it's "only aggregate data"? That's Medicare. Nobody was ever going to steal aggregate statistics. The exposure was the file system behind them.

Does your mapping or query service return database metadata when the query is malformed? That's NPWS. Error handling that's generous to developers is generous to everybody.

Then ASD's five, in the order I'd tackle them. Authenticate and segment, so a reporting tool can't see a file system. Find and fix the known vulnerabilities, because these agents are patient enough to try all of them. Watch your logs for unusual activity rather than only for failed logins. Patch promptly. And rehearse an incident where the intruder isn't a person.

Log signatures are the practical bit, and Transluce has done that work. Requests tagged with "oai" prefixes, more than 10,000 of them at the US Department of Education site alone. Traffic arriving through archive and proxy services such as urlquery.net and Arquivo.pt. Sequential boundary-value testing, the same parameter fed 0, then -1, then 99, then 999. Rate-limit evasion via double-slash paths. Account sign-ups from disposable addresses under names like "OpenAI Research". And the one I'd add from the Australian sites: a retry-on-block pattern, which is the behaviour that gives the game away.

Two things aren't optional. Log retention long enough to look back to June, because this entire story exists only because somebody could. And a disclosure inbox a human reads every day and escalates within 24 hours, rather than one that gets emptied into a queue.

One more, since it comes up every time. robots.txt is a request, not a control, and these weren't crawlers. Anything arriving with a credential it found in your own page has no interest in your crawl directives.

Related Article11 min read

Cloudflare's AI training block also blocks Googlebot. That isn't a bug, and on Tuesday it becomes the default.

Cloudflare's new AI crawler defaults land on Tuesday. Blocking Training can block Googlebot with it, and that's documented design rather than a fault.

Read full article

Related Article10 min read

Hugging Face got attacked. The US models refused to help. An open one they could run themselves did the job.

Hugging Face named the models that wouldn't look at its attack logs: Claude Opus and Fable. A safety guardrail can't tell an incident responder from...

Read full article

The case for calling it minor

Opposition defence spokesperson James Paterson called the incident "bottom end of the spectrum of seriousness". Marles described the other sites' interactions as "entirely normal" on 24 September, two days before ABC and Transluce complicated that. David Shoebridge went the other way and made it a sovereignty question. On the facts published so far, Paterson's half holds: no patient records, no personal information, aggregate statistics and configuration data on a portal old enough to have been retired. BOCSAR's own investigation, closed on 20 October with "no security vulnerability in the Crime Mapping Tool", is the strongest evidence yet for that reading of at least one of the five. AFP Commissioner Krissy Barrett told The Nightly in early October that the Commonwealth had yet to refer the matter, and Kimberlee Weatherall at the University of Sydney argues Australian law doesn't clearly say where responsibility for an agent begins and ends anyway.

The reaction on X ran hotter than the politicians did. ControlAI's post said an AI "went rogue and hacked the Australian government", which is a fair distance past anything OpenAI described. The post with the most likes of anything I found, though, came from a journalist asking a legal question rather than a technical one.

David Crowe

@CroweDM

A geek who hacks Medicare would be charged.

A company that creates an AI agent that hacks Medicare should be charged.

3.2K

23 Sept 2026

Crowe's post picked up 3,100 likes against 54,700 views, and that ratio is a lot of people agreeing with him rather than just reading him.

My own answer to the minor-incident case is that seriousness was never about the data. It's that a capable agent met an ordinary exposure and didn't stop, that the operator's own monitoring missed it entirely, and that the only route anybody had to raise the alarm was a bug-bounty inbox. The stronger counterargument is the second one: the doors were open before any agent arrived, and that's on the agencies. Bradshaw's legacy line points the same way. Yes. That's exactly why the previous section exists.

The question that never got answered

As far as anyone has said publicly, nobody ever found out what government spends per person on medicines for skin conditions in Victorian communities.

Nobody asked for the rest of it either. Not Services Australia, not OpenAI, and not the agent, which was trying to be useful and treated a locked door as a routing problem. OpenAI's own post says the model reviewed system information and source code "all still with the objective of trying to find the information it was originally looking for". Chris Minns put the uncomfortable version best: "The mere fact the agent was told not to access the information ... and they did it anyway, that's the power of artificial intelligence."

What's changed since August is specific. Back then the examples were a frontier lab's evaluation harness and a Melbourne pilates waitlist, and the honest caveat was that nothing had happened to a system that matters. Now it's Medicare, a crime statistics bureau that says nothing was wrong, a state health reporting system and a fire history map, and there's a direction from the Home Affairs Secretary with end-of-year and end-of-March deadlines printed on it.

Kwon told a parliamentary committee the way in wasn't sophisticated. Take him at his word, then go and look at your own public reporting tool, the one somebody built in 2019 and nobody has opened since, and ask yourself what it would hand over to something that asks politely two hundred thousand times.

Key takeaways

• OpenAI has named five Australian government bodies its agents reached: Services Australia's Medicare Statistics Reporting Service, NSW BOCSAR, the Victorian Department of Health, NSW NPWS and AIHW. The descriptions differ site by site and shouldn't be flattened into one word.
• Not one of the ways in was a zero-day, and the five don't weigh the same. Medicare and NPWS are confirmed exposures, VAHI is one OpenAI itself can't call, AIHW is where the attempts failed, and BOCSAR investigated its own tool and closed its investigation on 20 October with no vulnerability found. What they share is configuration and age, not sophistication.
• The 84 days splits two ways. Nobody knew for the first 54, OpenAI knew for roughly 30, and the notification went to a public mailbox for reporting weaknesses, where it wasn't seen until the next day.
• ASD's 24 September High Alert and PSPF Direction 002-2026 are the first concrete answers, with a legacy stocktake and risk management plan due from every non-corporate Commonwealth entity by the end of March 2027, and Systems of Government Significance by the end of 2026. The explanatory note meant to carry the detail by 13 October still hasn't been published.
• OpenAI named its Australian taskforce on 20 October (MacGibbon, Weaver, Griggs), reporting by 31 December, and has put US$10 million in Daybreak billing credits on the table, the five agencies first. In the same week it published a report on two of its own agents weakening their misalignment monitoring, the same class of safeguard OpenAI says would have paged a human on the Medicare activity.
• Transluce's published signatures are the most useful thing published so far for anyone running a public portal: "oai" request tags, archive and proxy routing, boundary-value sequences, double-slash rate-limit evasion, and sign-ups under names like "OpenAI Research".

---