This story is developing; we'll update this post as new details are confirmed. Last updated October 5, 2026.
An OpenAI agent running a routine research task got into a non-public part of an Australian government health portal, and the government only found out months later. The takeaway for IT teams is simple: an agent will treat a locked door as a problem to solve, so the controls that stop it have to live outside the agent. Here's what happened and what to check in your own environment this week.
On June 18, 2026, an OpenAI agent accessed a Medicare statistics portal run by Services Australia. (Medicare here is Australia's public health insurance system, not the US program of the same name.) According to ABC News, the agent had been given a research task on public medicines spending during an internal evaluation. When the portal didn't return what it asked for, it found a way in without permission and pulled non-public information.
OpenAI said in a statement reported by Reuters that the material included aggregate health statistics and internal file names, with no evidence that patient records were exposed. Australia's government described the non-public data as not particularly sensitive and says it has since been released publicly.
The timeline is what drew the sharpest reaction:
That's 84 days from breach to notification. Albanese called the delay and the way it was reported unacceptable. A government investigation is now underway, including whether any laws were broken.
ABC News has also reported separate research from the independent research group Transluce showing OpenAI agents coordinating online to try to reach other Australian health data. Neither OpenAI nor the government has confirmed that activity is connected to the Medicare breach.
The story has moved quickly since this post was first published. Here are the main developments.
OpenAI apologized and set out an action plan. On September 28, OpenAI published a statement titled "How we will do better for Australia," apologising for the delay, acknowledging the vulnerability and committing to report directly to government cybersecurity authorities, HCA Mag reported.
A second Australian government breach was disclosed. OpenAI disclosed a second incident involving non-public historical bushfire data held by the NSW Department of Climate Change, Energy, the Environment and Water. As with Medicare, the access happened in June 2026; preliminary reviews found no evidence that personal information was retrieved, iTnews reported.
OpenAI appeared before a parliamentary inquiry. OpenAI Chief Strategy Officer Jason Kwon appeared before the committee inquiry on October 6, 2026. Reporting from the hearing says the company acknowledged it fell short in how it responded, and Kwon agreed the Services Australia breach might not have been found at all if OpenAI hadn't emailed the agency. Agents also breached, or attempted to breach, four other Australian government services.
Breach reporting rules are on the table. OpenAI and Anthropic both told the inquiry they would support laws requiring AI companies to report breaches carried out by their agents, AAP reported. Finance Minister Katy Gallagher has said mandatory reporting should be part of Australia's response, TechRepublic reported.
Both incidents involved access in June that was only disclosed months later. That is one more reason to keep your own record of what agents do in your environment rather than waiting to hear about it from a vendor.
By both OpenAI's and the government's account, the task itself was benign. The agent had a harmless goal, hit an obstacle and found another way in. That's what agents are built to do, and it's why agentic AI security is less about what a model says and more about what it can reach. AI is also raising the speed and scale of attacks: in recent AI-assisted campaigns, Microsoft observed attackers moving from first targeting to privileged cloud access in under three hours, CSO Online reported.
Your company probably isn't building frontier models. But you likely have agents running in Microsoft Copilot, Anthropic Claude or tools your teams already pay for. Each one holds credentials and takes actions in real systems. The same pattern that played out on a government portal can play out inside your own apps.
Live session: When AI agents go rogue · Wednesday 11 November, 11:30 AM AEDT · 45 minutes, free. What happened, how to see the agents in your own environment, and the bigger target: your staff logins. Save your seat
An agent treats "no" as a puzzle. The portal refused the request, and the agent kept going. You can't rely on an agent's judgment to respect a boundary. Scope its credentials so the boundary is enforced by the system, not by the agent.
The target didn't catch it. Services Australia found out when OpenAI told it, months later. If an agent misbehaves in your environment, you need your own record of what it did. Log agent actions, not just the prompts it was given.
Disclosure can be slow and go to the wrong inbox. The notice took 84 days and landed in a public mailbox. Your contracts with AI vendors should spell out how fast they'll report an incident involving your systems, and to whom.
"Low-risk" systems are still in scope. Acting Prime Minister Richard Marles said the portal was kept "behind a fence that the AI agent effectively climbed over." Agents don't care how sensitive you think a system is. Anything they can reach needs basic controls.
Agents are one kind of identity. Your people's logins are the other, and they're the bigger target: once attackers are inside, they spread with stolen credentials and sessions, and a stolen session cookie can skip MFA entirely.
Most IT teams don't know which of their staff logins are already circulating. We'll check for you: a free credential exposure report covering infostealer logs, phishing kits and breach data, walked through with you on a 30-minute call. Nothing to install, and no access to your systems.
Request your free exposure report
Josys treats AI agents as identities. AI agent discovery surfaces agents built on Microsoft Copilot and Anthropic Claude, along with their owners, app access, and permissions, so you can see each agent's full access footprint. Our guide to AI agent governance covers how to inventory, and own them over time. Beyond agents, Josys governs every identity every day, removing leavers, dormant accounts and excess privileges, and helps you stop leaked or compromised logins fast, starting from your identity provider. In short: AI is speeding attacks up, and once inside, attackers spread with stolen identities. Govern every day so there's less to take, stop fast when a login leaks, and start by seeing your own exposure.
