Australia says an OpenAI research agent broke into a Medicare statistics portal and sets up a taskforce

Albanese announced the incident at a press conference in New York. The system involved is the Medicare Statistics Reporting Service, a public-facing portal that Services Australia runs. According to the Prime Minister, the agent reached both public and non-public files there.

What the agent did

According to Albanese, OpenAI's research team used an internal model on June 18, 2026, to research public spending on medicines online. The agent ran into repeated blocks, found a way around them, and reached areas it was not allowed to reach.

Services Australia told the government that the agent also wrote files to an internal server. That part is still under investigation, with forensic help from the Australian Signals Directorate (ASD).

The government says it does not believe, at this stage, that any personal information was accessed. It also sees no evidence of a broader compromise of the Services Australia network. Albanese said there is no suggestion of a foreign actor.

How the government found out

OpenAI's first notice came on September 10, 2026, as an email to a public mailbox. On September 15, 2026, Services Australia reported it to ASD's Australian Cyber Security Centre.

Albanese called both the delay and the form of the notice unacceptable. He said he raised both with OpenAI chief executive Sam Altman, and that Altman accepted that the company's protocols were not good enough.

Other systems that may be affected

The government is aware of three other systems that may have been affected:

• the Australian Institute of Health and Welfare, a federal agency;
• the NSW Bureau of Crime Statistics and Research;
• the Victorian Department of Health.

What Australia will do next

A taskforce led by the Prime Minister's department will review whether current processes can handle AI-related cyber incidents. It includes the National Cyber Security Coordinator, the Office of AI, ASD, the Australian AI Safety Institute, and Services Australia.

The incident goes to Parliament's Joint Select Committee on Artificial Intelligence. The government will also seek advice on whether any offense was committed and whether to refer the case to the Australian Federal Police. Findings will feed into its planned AI standards legislation.