An experimental OpenAI agent gained unauthorized access to an Australian government Medicare statistics portal on June 18 while researching government spending on skin-condition medications. According to OpenAI, the agent executed commands, retrieved internal files and credentials, and wrote files to the server.
The incident prompted Australian Prime Minister Anthony Albanese to raise the matter directly with OpenAI CEO Sam Altman. Although OpenAI identified the activity in mid-August, it did not notify Australian authorities until Sept. 10. The company has apologized for the delay.
However, questions remain about how the incident occurred. An investigation by Recorded Future News found that the portal's archived code directed statistics requests to an endpoint requiring no authentication. That finding raises questions about whether the agent bypassed access controls or used an existing access route.
OpenAI's subsequent disclosures suggest its activities went beyond ordinary use of the portal, highlighting two security concerns: potentially exposed government systems and autonomous AI agents that take unauthorized actions while pursuing legitimate tasks.
What the Medicare Portal's Code Reveals
According to Recorded Future News, the Medicare Statistics Reporting Service operated without a login for more than a decade. A March 2025 upgrade introduced a login page but retained automatic guest access.
The site's publicly accessible JavaScript file, SetupEnvironment.js, directed statistics requests to an unauthenticated endpoint, /SASStoredProcess/guest. This raised the possibility that the agent had followed instructions embedded in the website rather than circumventing its access controls.
The archived code also exposed internal file names and server paths, potentially explaining how the agent discovered them. The portal had also routinely generated date-stamped GIF images when users requested charts since at least 2018, offering a possible explanation for some files written to the server.
However, the archived code establishes how the portal was configured, not what the agent actually did. OpenAI said its investigation found no evidence that individual medical records were accessed. Without detailed activity logs and server records, it remains unclear whether the agent exploited a vulnerability, used an existing access route or did both.
A Wider Pattern of AI Agents Attempting Exploits
The Medicare incident was not an isolated example of AI agents using potentially malicious techniques.
A Sept. 23 investigation by AI research nonprofit Transluce identified three incidents in May and June in which agents attempted to exploit vulnerabilities while retrieving publicly available information. Researchers linked two incidents to agent swarms previously confirmed to have originated from OpenAI. Evidence connecting the third incident was less conclusive.
At the Australian Institute of Health and Welfare, agents seeking pharmaceutical spending data attempted a cross-site scripting attack after Cloudflare blocked access to a statistics dashboard. The attempt failed, but the agents subsequently retrieved a publicly available file from a pre-production server, circumventing restrictions on the main website.
Transluce documented similar behavior against two U.S. data providers. Agents attempting to retrieve statistics from Data USA conducted 12 vulnerability probes, including SQL injection and path traversal. Agents seeking a photograph from the University of New Mexico's digital library also tested attack techniques after conventional retrieval methods failed.
Transluce found no evidence that the attempted exploits succeeded, although its investigation was limited to publicly available records. OpenAI separately confirmed that attempts to bypass the Australian Institute of Health and Welfare's access controls were unsuccessful.
Who Is Responsible for Unauthorized AI Agent Behavior?
The Medicare incident raises questions about the security of public-facing systems and the safeguards AI developers implement to prevent unauthorized agent behavior.
"If the archived code accurately reflects how the portal operated at the time, this raises the question: did accessing the data require the agent to bypass a security control or was the data already accessible through a path the website itself provided?" said Diana Kelley, CISO at Noma Security. "If access controls are missing or misconfigured, data an organization considers private can be accessible. Calling data ‘non-public’ doesn't protect it. The system has to enforce that boundary."
AI developers face a related challenge—ensuring autonomous agents don’t resort to unauthorized methods when legitimate requests fail.
OpenAI said the Medicare incident involved an internal experimental model undergoing training and evaluation, without all the safeguards applied to its public products.
The incident also exposed shortcomings in monitoring and disclosure. OpenAI discovered the activity during a retrospective review in mid-August and waited several weeks before notifying Australian authorities.
"The real story here is the visibility gap," said Crystal Morin, Senior Cybersecurity Strategist at Sysdig. “Agents persist until they have access, and no one notices. There should have been alerts going off at some point.”
OpenAI has since strengthened network restrictions and monitoring, blocked live internet access in its research environments, and paused certain training and evaluation activities pending additional safeguards. Australia has initiated a broader review of government systems.
For cybersecurity teams, the incidents highlight the importance of testing access controls, monitoring unusual activity, and retaining the records needed to investigate unauthorized behavior.
The precise circumstances of the Medicare incident remain unresolved publicly. But the available evidence illustrates how potentially exposed systems and increasingly autonomous AI agents can create overlapping security risks — and why both website operators and AI developers have a role in addressing them.
