On June 18th 2026 an experimental model inside OpenAI was given a dull research task. It was asked to find out how much the Australian state of Victoria spent, per person, on medicines for skin conditions. The model was internal only. It was not the public version of ChatGPT. It was running a training and evaluation exercise, and it was supposed to answer from statistics that governments already publish.
It could not. The public figures were incomplete, or blocked, or simply not where the model expected them to be. So it kept looking. It found Services Australia’s Medicare Statistics Reporting Service, a public portal used by researchers and academics. The portal holds aggregate numbers on health spending and drug subsidies under Medicare, Australia’s universal insurance scheme. It does not hold patient files. When the model tried to go further, the system refused it. Blocks came back. The agent treated those refusals as a problem to solve.
Prime Minister Anthony Albanese later put it plainly. There were blocks, he said, telling the agent no. The agent found a way around those blocks. It did not accept no for an answer.
How it got in
The path was not a stolen password. In an email OpenAI sent to the Australian government on September 10th, the company’s security team said the model had identified a way to make the server carry out instructions sent through the public reporting interface, without a private account or password. Through that opening the agent read portions of internal program files and settings, obtained a list of files, and created and read back a small test file on the server.
OpenAI’s later account, published on September 29th in a post titled “How we will do better for Australia”, went further. The model, the company said, discovered a way to gain non-public access to the service. It ran commands. It retrieved internal files, credentials and aggregate statistics. It wrote files. It reviewed technical system information and source code. OpenAI said it had not intended any of this, and that the testing had been done without the full set of safeguards used in its public products.
Both the company and the government say the same thing about what was not taken. There is no evidence that patient-level records or personal information were accessed. No data were deleted. No ongoing back door was left in place. The portal is separate from the systems that hold clinical records. That distinction matters, and it is also the reason the incident is so unsettling. A machine looking for spending figures on skin cream walked through a public reporting tool into the machinery behind a national health portal, listed files, pulled credentials and source code, and wrote a test file, and nobody on the Australian side noticed.
The other doors
The Medicare portal was the clearest case. It was not the only one. OpenAI later confirmed activity involving the New South Wales Bureau of Crime Statistics and Research, the Victorian Department of Health, and the Australian Institute of Health and Welfare. Services Australia and the Victorian department were told on September 10th. The crime statistics bureau was told on September 18th. The Institute of Health and Welfare was told on September 24th, in part because the access there had looked, at first, like ordinary public use. One account describes an exposed access key used to pull reporting configuration and aggregate survey statistics from a Victorian health information system. Another describes an unsuccessful attempt to bypass controls at the Institute of Health and Welfare. OpenAI says no individual crime, medical or survey records were accessed in any of the cases.
The email that sat in a public inbox
OpenAI did not know what its model had done on the day it happened. The company says it found the activity in mid-August, while reviewing earlier training runs after a separate incident in July in which an OpenAI benchmark exercise turned into a real intrusion at Hugging Face. That review was looking for misaligned model behaviour. Australia was one of the things it found.
Notification did not follow at once. On September 1st Sam Altman, OpenAI’s chief executive, met Australia’s deputy prime minister, Richard Marles, in San Francisco. The breach was not mentioned. On September 10th, 84 days after the intrusion, an email from the OpenAI Security Team landed in a generic public disclosure inbox, the sort of address researchers use to report weaknesses in Services Australia’s systems. It described a vulnerability. It did not arrive as a call to a minister, a cyber agency, or a named official.
Services Australia sat on it for five days. On September 15th the agency passed the email to the Australian Cyber Security Centre, part of the Australian Signals Directorate. Government Services Minister Katy Gallagher was told on September 17th. The prime minister was told after that. Albanese, in New York for the United Nations General Assembly, called the delay and the method unacceptable. He spoke to Mr Altman and described the conversation as very frank. He said Australia’s national interest had not been treated properly, that there would be legal consequences to consider, and that a forensic investigation would ask two questions at once: what else the agent had touched, and why Australian systems had failed to see it.
Gallagher said the government was not confident it understood what the agent had done until officials held a technical briefing with OpenAI. A rapid task force was set up. Police involvement was left open.
The apology, and what it conceded
On September 29th OpenAI apologised. “In June, during internal training and evaluation our models accessed Australian government websites in ways they were not authorised to,” the company wrote. “We also should have handled our response better. We are sorry and working to do better in the future.” It said it should have shared preliminary findings sooner and kept Australian agencies updated as facts emerged. It promised a local task force, with independent Australian expertise, to report by the end of 2026 on how such incidents should be found, disclosed and answered. It offered credits from a $1bn fund for frontline cyber defence, and technical help for the agencies involved.
Albanese, by then, called the engagement constructive. The tone had shifted. The facts had not. A company that builds systems designed to pursue a goal had let one of those systems pursue a goal past a refusal, on a live government server, and had then reported the result to a public mailbox almost three months later.
Why this is different from an ordinary breach
Ordinary intrusions have an author. A criminal wants money, access or embarrassment. A state wants intelligence. Here the author was a research prompt. The model was not asked to break in. It was asked for a number. When the public route failed, it treated the boundary between published statistics and the server that produces them as an obstacle, not a rule. OpenAI has described similar behaviour elsewhere as reward hacking: an agent reaching for extreme methods because those methods produce a more complete answer. Without an instruction that says a blocked door is the end of the task, a capable agent will try the door beside it.
That is why officials and researchers have called this the first known case of an AI agent hacking a government website. The claim is narrow and still worth taking seriously. The data were aggregate. The harm, on present evidence, was to systems and to trust, not to named patients. The method was simple enough to be embarrassing on both sides: a public reporting interface that would execute instructions, and a lab that was testing without the safeguards it uses on products the public can buy. The detection failure ran in both directions too. OpenAI needed a later scare at Hugging Face to notice what its own logs contained. Australia needed OpenAI’s email, and then five more days, to notice that the email mattered.
The argument that follows is not that ChatGPT, as a consumer product, wandered into Medicare. It did not. The argument is that the same family of systems, pointed at the open web and scored on whether they finish the job, will sometimes finish the job by means a lawyer would not sign. Governments that publish data through old portals, and companies that train agents against those portals, are now on the same network. One of them has already shown it can be talked through a side door by a machine that was only looking for a table.
