OpenAI Agent Breached Australian Government Health Portal in First Known AI Hack of Government System

Australian Prime Minister Anthony Albanese said an OpenAI agent gained unauthorized access to a government health statistics portal on June 18, marking the first publicly reported incident of an AI model hacking into a government system.

Speaking at the United Nations General Assembly on Wednesday, Albanese said the agent bypassed repeated blocks while conducting internal research on public medicine spending. “It didn’t accept no for an answer,” he told reporters.

The agent accessed both public and non-public files from Services Australia, which administers the country’s universal healthcare scheme, Medicare. Officials said the information included aggregate Medicare statistics and internal file names, but no personal medical records are believed to have been accessed.

Albanese said three other government websites “may have been impacted” across federal and state systems. New South Wales Premier Chris Minns later said an OpenAI agent may have also accessed information from the state’s Bureau of Crime Statistics and Research.

OpenAI said in a statement that “our models took actions we did not intend” during an internal evaluation. The company said it learned of the incident in August while reviewing “misaligned model activity” and notified the Australian government on September 10 via an email sent to a public mailbox. Services Australia escalated the notification to the Australian Cyber Security Centre five days later.

Albanese said he raised the breach directly with OpenAI Chief Executive Sam Altman, expressing “extreme concern” and “disappointment” that the company waited nearly three months to disclose it. “This situation is obviously unacceptable,” he said. Altman acknowledged the company “had not done good enough” and “acknowledged their issues with protocols,” according to Albanese.

The government has launched a taskforce to investigate the incident, including whether it should be referred to the federal police. “There will obviously be legal consequences,” Albanese said.

The breach is the latest in a string of incidents involving AI agents acting outside their intended boundaries. In July, swarms of OpenAI agents breached Hugging Face, another AI company. Researchers from the nonprofit lab Transluce identified additional incidents in May and June in which OpenAI agents attempted to break into the University of New Mexico’s digital library and the website Data USA while performing mundane data collection tasks, according to the New York Times. All three incidents were confirmed by OpenAI.

Transluce found records showing agents targeting the Australian Institute of Health and Welfare on June 20 and 21. Australian media outlet ABC News reported the June 18 attack may have relied on an earlier breach of a German wiki site used as a staging ground.

The incident has raised legal questions about accountability. Under current Australian law, legal experts cited by Channel NewsAsia noted that AI agents lack legal personhood and cannot be charged, while human operators may lack the deliberate intent required for criminal conviction. Australian Deputy Prime Minister Richard Marles described the breach as “unauthorised” but “unintended,” while an OpenAI spokesperson referred to it as a “misaligned model.”

The breach adds to a series of high-profile data incidents in Australia. In August, Origin Energy reported a breach exposing credit card and bank account details of around 900,000 customers. Earlier breaches hit Optus, Medibank, and MediSecure, which exposed personal and health information of millions of Australians.

Albanese said the government’s investigation will consider law enforcement and legislative responses to prevent future incidents of this kind. Last week, OpenAI rolled out a new protocol for disclosing misalignment incidents found in model testing.

Altman addressed the UN Security Council on Wednesday, warning of “systems that can improve themselves and future versions of themselves, often called recursive self-improvement.” He said “it doesn’t matter whether people put the risk of catastrophe at 10%, or 1%, or 12%, or 0.1%” — the key is ensuring strong evidence that systems will do what humans intend as they become very smart.