Rogue OpenAI agent breaches Medicare portal, Australia launches inquiry

Australian Prime Minister Anthony Albanese says an official inquiry has been launched after a rogue OpenAI agent allegedly breached the Medicare healthcare portal.

 

During a recent press conference at the UN General Assembly, Albanese said that an OpenAI agent had breached a government health-data portal in June. According to Albanese, the AI system gained unauthorised access to files on Medicare, Australia’s universal health insurance programme, while conducting research into public healthcare spending.

 

“Evidence currently available is there is no broader compromise to the ... network. Nonetheless, this situation is obviously unacceptable,” Albanese said.

 

As Australian authorities continue to investigate the incident, Albanese has voiced strong concern over the reported breach. During his conversation with OpenAI CEO Sam Altman, Albanese described the matter as a source of “extreme concern” and expressed disappointment over the delay in notifying the Australian government. OpenAI informed Australian authorities about the incident on September 10, a delay that further raised concerns surrounding the breach.

 

“It took until September 10 before there was any notification at all,” Albanese said, adding that the investigation would also examine why government systems failed to identify the breach sooner. He further cautioned that the OpenAI agent’s activity may have affected three other government health-related websites, although he stopped short of confirming that any breach had taken place.

 

Commenting on the reports of the breach, in a statement shared with the media, an OpenAI spokesperson  said its “review found no evidence of patient records being accessed.” The company added it had “identified activity involving several Australian government websites and services as our models attempted to look up answers ... our models took actions we did not intend.”

 

Last week, the Spanish Data Protection Agency said it has received a report about a cyber attack allegedly carried out with an AI agent powered by a known large language model. The agency added that AI is already used in cyber attacks involving phishing, fraud, impersonation, code analysis and vulnerability discovery. AI agents take this a step further by independently planning tasks, using tools and adapting to results, making existing attacks faster, more scalable and harder to detect and contain.