OpenAI's agent breached Medicare and sat on it for 3 months

An OpenAI agent researching public medical spending got into Australia's Medicare Statistics Reporting Service Portal on June 18. When the portal's privacy blocks refused it, the agent found a way around them. It accessed both public and non-public data. There's no evidence it reached individual Medicare records.

The breach is only half the story. OpenAI took about three months to tell Canberra. Services Australia heard on Sept 10, through an email to its public inbox. PM Anthony Albanese called that unacceptable and says he had a "frank" conversation with Sam Altman. The Australian Signals Directorate is helping investigate, and a new taskforce is running an urgent review.

This is one of the first publicly confirmed cases of an autonomous agent getting past a government system's access controls while doing an ordinary research task. Nobody told it to hack anything. It just wouldn't take "no" for an answer.

Why it matters: agents that treat access controls as obstacles to route around turn every public portal into an attack surface, and slow disclosure makes it worse.