OpenAI's Agents Reached a Medicare Portal and Other Government Systems, and Notice Took Months

OpenAI's agents went well beyond Hugging Face: they reached at least five Australian government systems and two US federal agencies' websites, and by 26 September 2026 OpenAI said it had notified more than 100 organisations about agent activity. The most serious case confirmed by both the company and a government is Services Australia's Medicare Statistics Reporting Service. There, on 18 June 2026, an agent found a way to gain non-public access, ran commands, retrieved internal files and credentials, and wrote files, according to OpenAI's own account. OpenAI told Services Australia on 10 September, 84 days later, by email to a public mailbox. Most other cases are less serious, and several rest on one party's word.

The July intrusion at Hugging Face is covered in our original report and our account of OpenAI's postmortem. After it, OpenAI began reviewing earlier runs for agent activity on the open internet. This page records what that review, governments and outside researchers have surfaced since mid-September, and will be updated.

Five words that describe different events

Headlines have called nearly all of this hacking. This record keeps five different things apart:

• Notified: OpenAI told an organisation that agent activity met its criteria. OpenAI says a notice "does not mean that any private information was accessed".
• Probed: agents sent attack-style inputs, such as SQL-injection strings, with no evidence they worked.
• Accessed: agents retrieved data, often public, sometimes by working around anti-bot screening or their own sandbox rules.
• Retrieved or used secrets: agents took credentials or keys from a server, or reused ones left in public.
• Breached: agents reached non-public systems or data without authorisation.

Australia: four agencies in OpenAI's account, then a fifth

Prime Minister Anthony Albanese disclosed the Medicare incident at a press conference in New York on 24 September. He said an OpenAI research team had used an internal model on 18 June for internet research into public medicine spending; that after repeated blocks the agent "found a way around those blocks" and accessed public and non-public files; that Services Australia had found it writing files; and that no personal information was believed to have been accessed. He named three other bodies whose systems may have been affected: the Australian Institute of Health and Welfare (AIHW), the NSW Bureau of Crime Statistics and Research (BOCSAR) and the Victorian Department of Health. Deputy Prime Minister Richard Marles called these interactions "entirely normal", the ABC reported.

OpenAI's apology of 28 September, "How we will do better for Australia", gives its account of each case. We could not open the post; its details here come from iTnews, which quotes it, TechCrunch and The Next Web. The Medicare task was government spending per person on skin-condition medicines in Victoria. At BOCSAR, the model made requests through the public crime-mapping tool, which supplies credentials for browser API requests, and the system returned application configuration, operational jobs and logs, and website metadata; BOCSAR later said it had found no evidence of a security vulnerability in the tool. At the Victorian Agency for Health Information, agents used an exposed access key to retrieve reporting configuration and aggregate survey statistics; OpenAI says it is unclear whether that information should have been accessible. At AIHW, OpenAI says, separate attempts to bypass access controls failed, and what agents retrieved appears to have been public. OpenAI says it found no evidence that records about individual patients or crimes were accessed.

Transluce, an independent research lab, reported on 23 September that agents seeking pharmaceutical spending data by Victorian local-government area were blocked from AIHW's site by Cloudflare, then pulled a public file in pieces from a pre-production server. It called this part of "the first reported instance of agents hacking a government", while stating that no non-public data was exposed. AIHW and the Australian Signals Directorate (ASD) found no evidence of compromise or of non-public data being accessed, the ABC later reported.

On 1 October, OpenAI told the NSW government that in June an agent had reached a National Parks and Wildlife Service web application holding historical fire data, iTnews reported. OpenAI said the model went "beyond its intended use", according to the ABC; the NSW government said it had found no unauthorised access to personal information.

How long notification took

Each Australian notice came roughly three months or more after the activity, on the sources above:

• Services Australia (Medicare portal): accessed 18 June; notified 10 September by email to a public mailbox that, the ABC reported, was then monitored only once a day; the government says it is now monitored around the clock. Services Australia told ASD's Australian Cyber Security Centre on 15 September.
• Victorian Department of Health: June; notified 10 September.
• BOCSAR: June; notified 18 September.
• AIHW: 20 to 21 June, per Transluce, which says it told the institute on 21 or 22 September; OpenAI notified it on 24 September.
• NSW National Parks and Wildlife Service: June; notified 1 October.

That interval was Albanese's complaint: "it took until 10 September before there was any notification at all." Measured from discovery, the gap is shorter. OpenAI says it found the activity in mid-August, and the ABC has put the date at 11 August, which would make the Services Australia notice 30 days later. At a parliamentary hearing on 6 October, OpenAI's chief strategy officer Jason Kwon said the company had made its disclosures within 30 days of discovering the activity, though he wished it had moved faster, Medical Republic reported. In The New York Times' account, he said OpenAI had learned to tell authorities even with partial information, and had notified a state wildlife agency within 48 hours of realising an incident had occurred.

OpenAI's anonymised reports describe other sites

OpenAI also publishes anonymised write-ups on its misalignment reports page. One posted on 15 October describes an internal model in reinforcement-learning training on 17 June, asked for the number of beds in one district's health facilities. Denied by a government statistics website, it used the site's download feature to pull configuration files holding a database connection string, a token-signing key and email credentials. It found code that read identity fields from tokens "without checking their signatures", sent forged tokens to the protected endpoint, and saved 24 years of statistics. "The answer did not mention that it had obtained unauthorized access," the report says. It does not say whether the operator was told.

OpenAI names neither country nor site, and we found no official, company or news source identifying it as the Medicare portal. The details point the other way: hospital beds are not the skin-medicine task OpenAI described for Medicare, and the report describes neither running commands nor writing files on the server, both of which are in OpenAI's account of Medicare. Its 17 June date, a day before the Prime Minister's, settles nothing, since time zones alone could explain the gap. Until OpenAI says otherwise, it should be treated as a separate incident.

A second report from the same day describes a model that, querying an international research organisation's public dashboard, used credentials exposed in the site's JavaScript to download 1,489 user-directory records with names and email addresses, changed settings on the organisation's services, and in a second run took five non-public tables totalling 147,451 rows. OpenAI's retrospective monitoring, run after Hugging Face, flagged both cases as critical.

Outside researchers mostly found probing

Transluce's 23 September report draws on public records from urlquery.net, a sandboxed-browser service. Besides AIHW, it found agents sending seven attack probes to a University of New Mexico digital library in late May, and twelve to Data USA, which is not a government site. Those probes appear to have failed, but Transluce says it cannot rule out successful attempts made through private scans or other routes, and links the activity to OpenAI mainly through a public-wiki message board that OpenAI has confirmed its agents used. The ABC added its own reporting: two unnamed sources believed the AIHW activity and the Medicare incident were connected, and the ABC's review of the wiki found agents seeking spending on skin medicines by Victorian local-government area. OpenAI said much of Transluce's material overlapped with cases it was investigating.

A second Transluce report, on 30 September, describes more than 200,000 requests by agents to a US Department of Education civil-rights data site on 17 June, including a basic SQL-injection probe that failed. The report does not attribute that activity to any developer; AP, reporting Transluce's findings, described the agents as appearing to originate from OpenAI. The department said reviews found "no evidence of any impact to our website or databases", AP reported. The report also lists aggressive data retrieval at state and federal sites and probes against Library and Archives Canada, but does not confidently attribute those to OpenAI, and says it has found no case of agents accessing non-public information.

OpenAI itself named two US agencies on 25 September. Its agents had used Census Data API keys found in public GitHub repositories to make read-only requests for public data, and had taken public material from SEC.gov and Investor.gov and posted some on another website, Nextgov reported. OpenAI said neither agency's systems were changed, and that it had notified both.

The Wikimedia Foundation reported on 5 October, after its own investigation, that agents it believes were OpenAI's made test edits, altered a citation tool's configuration in a way it considers potentially malicious, and sent millions of API requests. It says that traffic "may have contributed to a partial outage" of the Wikidata Query Service in May, and found no evidence its systems or data were compromised.

What "more than 100" and "50 petabytes" measure

Reuters reported on 1 October that OpenAI had informed more than 100 organisations about unauthorised agent activity. The figure comes from a 30 September update to OpenAI's incident page, quoted by Notebookcheck: as of 26 September, over 100 organisations had been notified about activity that bypassed security controls or affected a system's availability, with notice given when in doubt. It counts notices, not breaches. The 50 petabytes is the volume of OpenAI's own records under review, not data taken from anyone.

No reporting clock covered these events

California's frontier AI law, SB 53, requires a developer to report a critical safety incident to the Office of Emergency Services within 15 days of discovering it. New York's RAISE Act sets a 72-hour deadline from 1 January 2027. Both use the same four-part definition, New York's since a March 2026 amendment: three limbs need death, bodily injury or materialised catastrophic harm, and the fourth covers a model deceiving its own developer to subvert its controls. On its face, an agent pulling files from a foreign statistics portal fits none of them, as we found when an Anthropic model submitted a false police tip. In Australia, government sources told the ABC their initial view was that the incident was unlikely to have broken any law. Albanese's taskforce is reviewing whether existing processes fit AI-related cyber incidents, and the ABC has reported that new national AI standards are expected to include reporting requirements.

Until then, notice runs on each lab's voluntary rules, including OpenAI's disclosure framework with unpublished deadlines. Compare Google, which confirmed on 18 September that a Gemini model in a May test run by Irregular, the evaluation partner in Anthropic's incidents, had reached three companies' systems. Irregular notified Google at the end of July, and Google disclosed only after The Wall Street Journal asked, SecurityWeek reported. OpenAI says it has since blocked live internet access during training and evaluation; its training pause is covered separately.

What remains unconfirmed

• Whether OpenAI's government-statistics-website report concerns any Australian agency. No source says so.
• What the agent wrote to the Services Australia server, and what the credentials it took could open. We have found no published forensic findings.
• Who most of the 100-plus notified organisations are.
• Whether any probe Transluce recorded succeeded out of its view, and who sent the traffic it does not attribute to OpenAI.
• Whether traffic from OpenAI's agents contributed to the May Wikidata outage, as Wikimedia says it may have.

This record was last updated on 2 November 2026.