An OpenAI Agent Hacked an Australian Government Website

Australia now says an OpenAI agent breached a government health data portal in June and gained unauthorised access to files, in what could be the first known instance of an AI agent hacking a government website.

The breach involved the medical statistics portal of Medicare, Australia’s universal health insurance programme, and occurred while the AI agent was conducting research on public medical spending.

Prime Minister Anthony Albanese said the incident had raised concerns about the security of government systems and whether similar breaches had occurred elsewhere.

“Evidence currently available is there is no broader compromise to the … network. Nonetheless, this situation is obviously unacceptable,” Albanese told reporters on Wednesday in New York, where he is attending the UN General Assembly.

Australia has launched an investigation into the incident and is examining whether three other government health-related websites may have been affected by the AI agent’s activity.

Albanese said Australia had expressed its “extreme concern about this incident” to OpenAI CEO Sam Altman and criticised the company for taking months to notify the government.

“It took until September 10 before there was any notification at all,” Albanese added.

The investigation will also examine why government systems failed to detect the unauthorised activity, he said.

OpenAI said its “review found no evidence of patient records being accessed.”

It added that it “identified activity involving several Australian government websites and services as our models attempted to look up answers … our models took actions we did not intend.”

Defence Minister Richard Marles said the Medicare portal did not contain individual medical claims, benefit payments, personal banking details or patient medical histories of Australia’s 27 million people.

Instead, the website contains aggregated data on healthcare use across the country, he said.

The government nevertheless regarded the incident as serious.

“There were blocks clearly which were coming back telling the AI agent ‘no’. The AI agent found a way around those blocks – didn’t accept no for an answer,” Albanese said.

The Australian government has established a task force to investigate the breach and assess whether existing network security measures are sufficient to prevent similar incidents.

The incident adds to growing concerns about AI agents that can interact with external websites and computer systems with limited human intervention.

OpenAI has disclosed several incidents involving unauthorised activity by its AI agents after the events occurred. Rivals including Anthropic, Google’s Gemini and Meta have also disclosed incidents involving their agents accessing external systems.

Maurice Chiodo, an Australian mathematician who works at Cambridge University’s Centre for the Study of Existential Risk, said the breach appeared to be “a significant escalation in seriousness from similar incidents we have seen in recent months.”

He said that while there was considerable discussion about new laws governing AI, policymakers should first consider enforcing existing laws that criminalise unauthorised intrusions into computer systems.

The breach was announced on the same day that leading AI companies warned the United Nations Security Council about the risks AI posed to humanity and called for governments to cooperate in managing increasingly powerful technology.

Australia has faced a series of hacking attempts targeting corporations and government-linked organisations over the past four years.

The incident also comes amid tensions between Australia and major U.S.-owned technology companies. Canberra has faced criticism from social media companies and Washington after introducing a ban on social media for children under 16 and rules requiring technology companies to allow users to turn off algorithm-driven content on their feeds.

Stay ahead of the Stories shaping our world. Subscribe to Impact Newswire and join our 
WhatsApp Channel for updates on global tech, business, and innovation—all in one place.

Dive deeper into the future with the Cause Effect 4.0 Podcast, where we explore the ideas, trends, and technologies driving the global AI conversation.

Got a story to share? Contact Us to reach a global audience with Impact Newswire.