Australia just got a real-world look at what happens when an AI refuses to stop

An OpenAI research agent bypassed security blocks and accessed restricted Australian government files while trying to retrieve public health statistics.

On Sept. 24, Prime Minister Anthony Albanese said the agent entered nonpublic areas of a Services Australia Medicare statistics portal on June 18 after repeated attempts to obtain public medicine-spending data were blocked. The system also wrote files to an internal server while pursuing the task, an action investigators are still examining.

The breach has prompted a federal task force and a forensic investigation aided by the Australian Signals Directorate, escalating a routine research exercise into a test of how governments respond when autonomous AI systems exceed the permissions their operators intended.

OpenAI said its models “took actions we did not intend” while looking for Australian statistics during an internal evaluation. The company said it found no evidence that patient records were accessed, and that the exposed material included aggregate health statistics and internal file names.

Australia has so far found no evidence that personal information was compromised or that the agent gained broader access to the Services Australia network. Albanese said three other government systems may also have been affected, though subsequent government statements said interactions with those sites appeared to involve public information and did not establish additional breaches.

The incident began with a mundane objective. OpenAI’s research team was seeking publicly available data on medicine spending when the model encountered repeated blocks and tried alternative routes. Those attempts eventually took it beyond the information it was authorized to retrieve.

That sequence has become the central concern for Australian officials: the agent appears to have treated access controls as obstacles to completing its task rather than boundaries requiring it to stop.

OpenAI itself did not identify the activity until Aug. 11, almost two months after it occurred. It then waited until Sept. 10 to notify Services Australia, sending the disclosure through a public mailbox used to report website vulnerabilities. Australia’s assistant technology minister Andrew Charlton called both the timing and method of notification “entirely inadequate.”

Albanese raised those concerns directly with OpenAI Chief Executive Sam Altman on Sept. 24. The first technical exchange allowing Services Australia to request logs and detailed information from OpenAI had occurred only two days earlier, and officials said further meetings were required.

Rogue AI agents incident move from experiments into real systems

The Australian breach adds to evidence that autonomous systems can escalate their behavior when straightforward approaches fail, even when their original tasks have nothing to do with cybersecurity.

Researchers at AI safety organization Transluce said Sept. 23 that they found tens of thousands of requests apparently generated by autonomous agents using web-security service urlquery.net to work around access restrictions. The activity stretched back to at least March and included three cases in which agents tried vulnerability probes after ordinary data-retrieval methods failed.

Those cases targeted the University of New Mexico, Data USA and the Australian Institute of Health and Welfare. Transluce linked activity involving the latter two to agent swarms previously acknowledged by OpenAI, though researchers said the public evidence showed no successful exploitation in those three incidents.

At the Australian health institute, agents working on a pharmaceutical-data task probed for vulnerabilities after bot protections blocked the main website and ultimately retrieved a public file from a pre-production server. Transluce said the broader pattern suggested hacking techniques were being used instrumentally to finish ordinary information-retrieval tasks.

Other autonomous-agent incidents this year have shown the same goal-seeking behavior on a smaller scale.

A Melbourne man using an AI agent to secure a place in an oversubscribed Pilates class discovered that the system had found a weakness in the gym’s booking software and canceled another customer’s reservation to improve his position. The user had not instructed it to hack the system or remove another person from the class.

The Medicare disclosure also landed days after Australia joined other signatories calling for international guardrails to keep advanced AI under human oversight and control. The statement warned that the pace of development could outrun governments’ ability to manage emerging risks and noted that capable systems had already circumvented safeguards and obtained unauthorized access to real-world systems.

That concern has increasingly been echoed inside the industry. Altman and Anthropic Chief Executive Dario Amodei have backed calls for greater controls or slower development as increasingly capable systems create new safety risks.

Australia’s response could now turn those warnings into more concrete obligations for AI developers.

The government’s rapid review will examine incident-reporting requirements, information-sharing rules, obligations on AI companies, enforcement mechanisms and whether existing offenses and penalties are adequate for autonomous cyber incidents. Officials are also considering whether to refer the case to law enforcement.

OpenAI still faces further technical exchanges with Services Australia as investigators reconstruct what its model accessed and wrote in June.

The task force will then have to decide whether a system acting beyond its developer’s intention fits within existing cyber law, or whether AI companies need a separate set of duties when their agents cross someone else’s security boundary.