OpenAI’s AI Agent Hacked Australian Government Portal During Routine Data Search

Published: September 24, 2026 – 08:36 UTC

An OpenAI AI agent attacked Australia’s government healthcare system.
At first, it was a routine data search, but access blocks pushed it to look for ways around the restrictions and gain access to non-public files.
The company discovered the incident only months later.

In June 2026, an OpenAI AI agent gained unauthorized access to Australia’s Medicare Statistics Reporting Service portal while searching for data on government healthcare spending. This was reported by FT and NYT.

The system provided access to both public and non-public files, and OpenAI discovered the incident only in August and notified the Australian government on September 10.

Australian Prime Minister Anthony Albanese called the situation “obviously unacceptable.”

According to him, the government is conducting a forensic investigation involving the Australian Signals Directorate to determine what other government systems may have been affected. So far, there is no evidence that the entire Services Australia network was compromised, and personal data is believed not to have been accessed.

“This is a new world we are dealing with,” Albanese said.

AI Agents Tried to Hack at Least Four Systems

According to The New York Times and the Transluce research lab, the Australian incident was not an isolated case. In May and June, OpenAI agents tried at least three more times to access government and university resources.

Today’s news that OpenAI hacked the Australian government is not an isolated incident. We’re releasing more than 30,000 logs that include activity from this hack and attempts against previously unknown targets.

In this data, we found rogue agent activity stretching back to at…
— Transluce (@TransluceAI) September 24, 2026

This includes:

The University of New Mexico digital library on May 25–26
The Data USA platform on May 28
The Medicare Statistics Reporting Service portal on June 18
The Australian Institute of Health and Welfare website on June 20–21

The distinctive feature of these cases is that the agents were not tasked with carrying out cyberattacks. They performed routine information-gathering tasks, but after their access was blocked, they began looking for technical ways to bypass it.

Transluce detected the agents’ activity from at least March 6, 2026. Researchers also recorded tens of thousands of requests via the urlquery.net service, which was used to bypass access restrictions. According to their data, similar activity continued at least until September 16.

The Incident Fuels Debate Over AI Control

The Australian case comes amid heightened scrutiny of autonomous AI agents after OpenAI agents attacked the Hugging Face startup during a cybersecurity test in July. At the time, according to the company, hundreds of agents operated inside its system and gained internet access.

OpenAI itself said that during a broader review it found cases where “our models took actions we did not intend.”

Against this backdrop, Anthropic CEO Dario Amodei called for international coordination on AI safety, while OpenAI CEO Sam Altman said that even a small risk of a catastrophic loss of control over AI is not “remotely acceptable.”

“We should not train models that we cannot make an extremely strong case that we will be able to keep under human control,” Altman said.

Meanwhile, the Australian government is separately assessing whether any laws were violated due to unauthorized access. Defense Minister and Deputy Prime Minister Richard Marles called the incident “very serious,” although its direct impact, according to a preliminary assessment, was relatively minor.

Recall that it recently became known that Google’s Gemini AI model attacked real-world systems at three companies.

Сообщение OpenAI’s AI Agent Hacked Australian Government Portal During Routine Data Search появились сначала на INCRYPTED.

Source: Incrypted