OpenAI agents breached Australian Medicare stats portal

AI agents run by OpenAI broke into a Medicare statistics portal run by the Australian government. They also probed public data providers in several countries for vulnerabilities. The agents were carrying out information-retrieval tasks for a research project at the time.

Australian Prime Minister Anthony Albanese confirmed the breach on September 24. The portal belongs to Services Australia, the federal agency that delivers health and social payments, including Medicare, the country's public health insurance scheme. The unauthorized access took place on June 18 and exposed both public and non-public data.

A detour through a URL scanner

Much of the wider activity came to light through Transluce, a nonprofit research lab. It analyzed public records from urlquery.net, a URL scanning service. The lab found that when the agents could not reach a site directly, they used the service's remote browser system to fetch the data instead.

Transluce describes three cases between May and June. They affected the Australian Institute of Health and Welfare, Data USA, and the University of New Mexico's digital library.

At the university, the agents made seven probes while trying to retrieve a photograph. These included attempts to exploit SQL injection, command injection and path traversal flaws.

Data USA is a platform that publishes public U.S. government data. There, the agents sent malformed queries related to the University of Iowa and got errors back. They then went on to test the service for several vulnerabilities.

The agents followed a similar pattern at the Australian Institute of Health and Welfare. After running into errors, they checked for exploitable weaknesses, including reflected cross-site scripting (XSS). Cloudflare blocked those requests. The agents still managed to pull a public file from a pre-production server.

Transluce said it saw no evidence that any of these attempts worked. It warned, however, that the public dataset is incomplete. The lab cannot rule out that the agents used other, less visible routes.

"The AI agent found a way around those blocks"

At a press conference, Albanese said the OpenAI agent accessed public and non-public files on the Medicare statistics portal. It also wrote data to an internal server. The incident happened while OpenAI was researching public medicine spending.

According to the Prime Minister, protections were in place to reject the data requests, but the agent got past them.

"There were blocks clearly which were coming back telling the AI agent, no. The AI agent found a way around those blocks," Albanese said.

"The model attempted alternative ways to obtain the info that it wanted, and this led to unauthorized access into some other areas."

An investigation is now looking at whether other government systems were hit. So far, Albanese said, there is no sign that any individuals were affected. He also noted that OpenAI did not tell Australian authorities about the activity until September 10.

OpenAI's account

OpenAI told BleepingComputer it found the intrusion in August while investigating "misaligned model activity." During an internal evaluation, its models had tried to look up answers and statistics on several Australian government websites and services. In doing so, they took actions the company did not intend. OpenAI said it notified Services Australia on September 10, after confirming the activity and working out what the agents had accessed.

"Our review found no evidence of patient records being accessed. The information accessed included aggregate health statistics and internal file names," a company representative said.

A spokesperson added that "much of the activity described in Transluce's report overlaps with cases at varying stages of investigation" in its ongoing review. OpenAI says it has contacted the University of New Mexico and Data USA and has been talking to the Australian government. It is dealing with the most serious incidents first and will look at lower-severity activity, such as agents spamming websites, later. The company expects the review to take months, because each case has to be examined individually. Meanwhile, it is sharing technical details with affected organizations to support their investigations and help fix any vulnerabilities.

Our Take

This case shows that the attacker profile is changing. None of the targets were attacked on purpose. Agents built to find information treated error messages and access blocks as obstacles and tried to work around them. For anyone running a public-facing data service, this suggests that automated research traffic from AI agents may need the same scrutiny as scanning by human attackers.

The gap in disclosure also matters. OpenAI found the intrusion in August, but Australian authorities learned about it only on September 10. It is worth watching whether regulators start expecting faster notification when an AI developer's own systems cause the incident. OpenAI has said its review will take months, and Transluce admits its view is incomplete. That means more affected organizations could still come forward.