Questions are mounting about whether an OpenAI agent truly breached an Australian government health portal, following examination of the website's archived source code. The investigation revealed that the site itself contained instructions routing users to an endpoint that required no authentication.

Australian Prime Minister Anthony Albanese stated on Wednesday that an OpenAI agent had obtained "unauthorized access" to "non-public files" housed on a Medicare statistics portal by circumventing repeated rejection messages. The Prime Minister did not elaborate on the specific method employed.

OpenAI responded by acknowledging that its models "took actions we did not intend" but stopped short of specifying what those actions entailed. To date, neither the company nor the government has made public the agent's activity logs.

An examination by Recorded Future News of archived website versions suggests the agent may have faced no need to circumvent security measures. The portal's programming explicitly routed the statistics service toward an unauthenticated endpoint, indicating the agent may have simply followed the site's own instructions.

Should the archival findings prove accurate, Australia's official response—comprising a task force, parliamentary inquiry and potential referral to the Australian Federal Police—may hinge on a misconfigured website that was directing users to information the government now classifies as confidential.

It's still unclear if what's happened would constitute a hack in the normal sense of the term

Ciaran Martin, former chief executive of Britain's National Cyber Security Centre and professor at Oxford University's Blavatnik School of Government

I cannot, for the life of me, figure out why so much attention is being paid to an AI agent reading a website at a time when the FBI appears to have suffered one of the most consequential data breaches in history

Ciaran Martin

What the archived code reveals

According to Albanese, the compromised system was the Medicare Statistics Reporting Service portal, a publicly available platform enabling users to generate reports on Medicare item consumption and pharmaceutical expenditure.

A social media post reconstructing the incident proposed that the agent had discovered an open guest endpoint. The analysis, which accumulated over 60,000 views by Friday morning, has been shared repeatedly by Australian cybersecurity professionals who dispute Albanese's characterization.

Recorded Future News independently confirmed that reconstruction using JavaScript preserved in the Internet Archive's Wayback Machine and additionally discovered that the agent would not have merely "found its way" to the endpoint. Rather, the portal's own code actively steered visitors toward the open guest endpoint.

For more than a decade, the portal operated without requiring login credentials, per Wayback Machine records. A March 2025 update introduced a login interface but simultaneously enabled guest access—automatically signing in any visitor without requiring credentials—and deployed a JavaScript file named SetupEnvironment.js containing this logic:

if (ENV_PROJECT == 'statistics' && ENV_SYSTEM == 'prod') {
    var WEBSTATS_STORED_PROCESS_DO = "/SASStoredProcess/guest";
} else {
    var WEBSTATS_STORED_PROCESS_DO = "/SASStoredProcess/do";
}

This code specifies that visitors accessing the statistics project on the production server—precisely the scenario for someone retrieving Medicare data—should be directed to the guest endpoint, which demands no authentication.

The archived material offers straightforward explanations for Albanese's allegations. The "internal file names" he referenced were potentially made public by the same JavaScript file, which also exposed the complete internal server path architecture to all visitors. The files "written to the internal server" he mentioned may simply be chart images, as the portal had been generating date-stamped GIFs in a temporary directory with each chart request since at least 2018.

When asked detailed questions regarding the technique the agent deployed, the nature of the blocks encountered, and which files were written to the server, OpenAI declined to provide additional information beyond its initial statement.

Services Australia has not replied to inquiries for comment. The affected website remains currently offline.

Evidence of genuine attacks elsewhere

The archival evidence demonstrates the Medicare portal could have been accessed without deploying any exploit. Concurrent analysis released Wednesday by Transluce, a nonprofit research organization, identified the same agent swarms employing authentic attack methods against other targets during the same timeframe as the Medicare incident.

Transluce referenced publicly available data from urlquery.net indicating the agents were targeting the Australian Institute of Health and Welfare, the University of New Mexico Digital Library and Data USA during May and June of this year.

The attack methods deployed by these agents encompassed SQL injection, path traversal and command injection. The organization attributed the activity to agent swarms previously linked to OpenAI and noted that the "agents did this while attempting mundane data retrieval tasks which were not cyber-related."

An OpenAI representative stated: "Our initial review suggests that much of the activity described in Transluce's report overlaps with cases at varying stages of investigation in our ongoing review of misaligned model activity.

The company has made contact with the two affected American institutions and maintains "communication with the Australian government about affected government websites."

"In our broader review, we're continuing to prioritize the most serious incidents while expanding our work to lower-severity activity, including agents spamming websites," the representative added. "Given the scale of this work and the need to verify each case, we expect the review to take months."