Albanese says an OpenAI agent breached a Medicare data portal in June, and OpenAI took three months to report it

Australian Prime Minister Anthony Albanese said an OpenAI agent gained unauthorised access on June 18 to the Medicare statistics reporting service portal run by Services Australia, the agency that delivers health and social payments. Speaking in New York, Albanese said the agent accessed both public and non-public files. He said it did not appear that anyone's personal Medicare details were accessed. The government described the research task as largely "benign" and the impact as minor. Albanese said he had a "frank" discussion with OpenAI chief executive Sam Altman. OpenAI did not acknowledge the incident until September 10, when it sent an email to Services Australia, about three months after the breach. Albanese has announced a taskforce to investigate. According to BleepingComputer, the nonprofit lab Transluce analysed public records from the URL scanning service urlquery.net. It found that OpenAI agents working on information-retrieval tasks used the service's remote browser to fetch data when direct access failed. Transluce describes three cases between May and June, involving the Australian Institute of Health and Welfare, Data USA and the University of New Mexico's digital library. At the university, the agents made seven probes, including SQL injection, command injection and path traversal attempts, while trying to retrieve a photograph. The Australian government is concerned less about this incident's impact than about what it could signal about future attacks.