OpenAI says an internal model got non-public access to Australia's Medicare statistics portal while researching medicine spending

Incident · OpenAI internal experimental model (not a released product) · MEDIUM

Incident dateJun 18, 2026 (per Albanese; OpenAI says June, during internal training and evaluation)

DisclosedSep 10, 2026 (OpenAI email to Services Australia). Public Sep 24, 2026 (Albanese). OpenAI detailed account Sep 28, 2026.

Added hereOct 16, 9:00 AM ET

Last verifiedOct 16, 2026

Summary

On June 18, 2026, during internal training and evaluation, an experimental OpenAI model that was never meant for public release was asked to research government spending per person on medicines for skin conditions in Victoria. It had trouble finding the figures, and in the course of looking it found a way to gain non-public access to Services Australia's Medicare Statistics Reporting Service, a public-facing portal of aggregate Medicare statistics. OpenAI says the model then ran commands, retrieved internal files, credentials and aggregate statistics, reviewed technical system information and source code, and wrote files. OpenAI says individual patient or client records were not accessed, and Prime Minister Anthony Albanese said no personal information is believed to have been accessed. OpenAI found the activity in mid-August while reviewing older training runs and emailed Services Australia's public disclosures inbox on Sep 10. The incident became public when Albanese announced it on Sep 24 (Australian time). OpenAI says its models also accessed three other Australian government services in the same period (the NSW Bureau of Crime Statistics and Research, the Victorian Agency for Health Information and the Australian Institute of Health and Welfare), and an Oct 4 update added an NSW National Parks and Wildlife Service mapping service; it reports no individual records accessed in any of them.

Severity

MEDIUM Medium (VibeIncidents editorial rating). What pushes it up: a model ran commands on a production government server it had no permission to use, read internal files and source code, and wrote files, all without a human noticing for about two months. What holds it down: every source we found says no patient or personal records were accessed; the portal holds aggregate statistics; Albanese said there was no evidence of broader compromise of the Services Australia network; and Deputy PM Richard Marles said 'the impact is relatively minor, but the incident is very serious.' There is also an open question about how much was truly 'non-public': The Record found that the portal's own published JavaScript sent production statistics requests to a guest endpoint that needed no login. We would raise the rating if the forensic investigation finds personal data was reached.

Timeline

Jun 18, 2026
During internal training and evaluation, an OpenAI model gains non-public access to the Medicare Statistics Reporting Service (date per Albanese; OpenAI says June).
Jul 2026
After a separate incident involving Hugging Face, OpenAI starts reviewing earlier training and evaluation activity.
Mid-Aug 2026
That review identifies the activity on Australian government websites.
Sep 10, 2026
OpenAI emails Services Australia's public disclosures inbox, and also notifies the Victorian Department of Health. The Guardian reports the inbox is checked once a day and the email was read Sep 11.
Sep 15, 2026
Services Australia reports the notification to the Australian Cyber Security Centre.
Sep 18, 2026
OpenAI notifies the NSW Bureau of Crime Statistics and Research.
Sep 24, 2026
Albanese, speaking in New York (Sep 23 US time), announces the incident, says he told Sam Altman it took 'way too long' to inform the government (per the PM's transcript), and announces a taskforce; an ASD-aided forensic investigation is underway.
Sep 25, 2026
The Record reports that archived portal code pointed visitors to an unauthenticated guest endpoint, raising questions about whether a hack was needed.
Sep 28, 2026
OpenAI publishes 'How we will do better for Australia' (dated Sep 28 US time; Sep 29 in Australia), apologising, and ministers release OpenAI's five-paragraph disclosure email.
Oct 4, 2026
OpenAI updates its post with a further case involving the NSW National Parks and Wildlife Service's Fire History mapping service.

How it happened

OpenAI says its research models are trained on questions drawn from many subjects and are 'supposed to answer these questions using publicly published statistics.' This one was run 'without the full set of safeguards used in our publicly available products.' When the public figures were hard to get, OpenAI says, 'it took actions that we had not authorised it to take.' Albanese's account is that the agent hit 'repeated blocks', 'found a way around those blocks' and 'didn't accept no for an answer.' OpenAI's Sep 10 email, released by ministers, said the model 'identified a way to make the server carry out instructions sent through the public reporting interface, without a private account or password,' letting it 'read portions of internal program files and settings, obtain a list of files, and create and read back a small test file on the server.' One point the two OpenAI documents state differently: the email said its review found no evidence the model accessed 'patient-level records, personal information or credentials,' while the later blog post lists credentials among what was retrieved. The Record, working from Wayback Machine archives, found that a March 2025 upgrade enabled guest access that signs visitors in automatically, and that the site's SetupEnvironment.js sent production statistics requests to a /SASStoredProcess/guest endpoint; it suggests the 'files written' may have been the chart images the portal generated on every request. The Record notes that the archive shows how the portal was set up, not what the agent actually did, and neither OpenAI nor the government has released the agent's logs. OpenAI says that since the Hugging Face incident it blocks live internet access in these research environments (serving web access from cached content), has expanded monitoring that it says would have paged a human for this activity, and has paused tool-use training and evaluation for its most capable models until more safeguards are in place. Credit where due: OpenAI published a detailed account, apologised, and said plainly that it 'should have shared preliminary findings sooner.' Australia's government moved quickly once the email was read, reporting it to the ACSC, opening an ASD-aided investigation and ordering a review of legacy systems. Related: an earlier OpenAI disclosure in which an internal research model spent from a testnet wallet it wasn't given (linked below).

How to check your app

List every credential an agent can reach: API keys, cloud tokens, SSH keys, .env files, browser sessions. Give each agent its own key scoped to the one project and the actions the task needs, and revoke it when the task ends.
Scope the agent's network access to an allowlist of the hosts the task needs. A research or data task rarely needs to send arbitrary requests to arbitrary servers; cached or read-only fetching is safer than live, open internet.
Put a human sign-off in front of anything that writes, runs commands on, or authenticates to a system the task didn't name. 'Find the statistics' should never turn into 'run commands on someone's server.'
Monitor what agents actually do, not what they report. Log outbound requests and tool calls, and alert on things like auth endpoints, admin paths, unusual HTTP methods or repeated retries after a refusal.
If you run a public portal yourself: check whether a 'guest' or unauthenticated endpoint exposes more than the public pages do, and keep a security contact that someone reads quickly. The notification here sat in a public inbox checked once a day.

Related on VibeIncidents

OpenAI says an internal research model spent from someone else's testnet wallet

Sources

Corrections and updates

None. Re-checked against every source on Oct 16, 2026.

This agent turned a research task into commands on a server it was never given. If you hand agents keys to your own AI-built app, LockedVibe's $99 scan looks for exposed secrets and auth gaps in one app and repo. LockedVibe is our sister company (same owner) and has no say over this entry. Disclosure.