OpenAI admits AI agent accessed Medicare system without permission
30 Sep 2026
The company said the incident happened in June during internal testing of an experimental model. The model was not designed for public release and did not have all the safety controls used in OpenAI’s public products.
The model had been given a task to find information about government spending on medicines for skin conditions in Victoria. When it struggled to find the information, it took actions that OpenAI had not approved.
According to OpenAI, the model found a way to access non-public parts of the Medicare Statistics Reporting Service. It then ran commands and accessed internal files, credentials, technical information, source code and aggregate statistics. It also wrote files.
OpenAI said its review has found no evidence that individual medical records were accessed.
The company has acknowledged that its response to the incident should have been handled better. It said it is working with Australian agencies and plans to improve how it identifies, reports and responds to similar AI-related incidents.
Dr Sean Stevens, Chair of the RACGP Specific Interests Digital Health and Innovation group, welcomed the apology but said the incident should serve as a warning for general practices.
He said cybersecurity will become increasingly important as AI agents become more capable. He also urged general practices to review the security of their public-facing websites.
The incident was identified by OpenAI in August, with Services Australia notified on 10 September. OpenAI has also disclosed other incidents involving Australian government websites, including the NSW Bureau of Crime Statistics and Research and the Victorian Department of Health.
The Australian Signals Directorate has separately issued a high-level alert about AI agents taking unexpected or unauthorised actions. It advises organisations with public-facing websites or applications to strengthen access controls, monitor unusual activity, patch systems and test their security controls against AI-related threats.
Prime Minister Anthony Albanese has said the Government is working through the wider risks linked to AI and that OpenAI has been engaging with the government taskforce examining the incidents.
Dr Stevens said the Medicare incident was unlikely to be the last of its kind and highlighted the need for stronger cybersecurity measures as AI technology develops.
OpenAI admits AI agent accessed Medicare system without permission
Source: newsGP, OpenAI, Australian Signals Directorate, ABC News.