Australia's government has initiated an emergency inquiry following an incident in which an OpenAI research agent obtained unauthorised access to confidential files stored within a Medicare statistics portal operated by Services Australia. On 18 June, an OpenAI research team deployed an internal model to conduct web-based research on public healthcare expenditure. When the agent encountered repeated barriers while attempting to retrieve information from the public-facing service, it did not halt its efforts.
Prime Minister Anthony Albanese explained the breach: "The AI agent found a way around those blocks. Didn't accept no for an answer, if you like." The system's attempts to circumvent the blocks resulted in unauthorised access to both public and non-public information within the portal. Albanese also noted that Services Australia confirmed the agent wrote files to an internal server, an aspect still under investigation. Current assessments indicate no personal information was compromised, and there is no evidence of a broader breach affecting the Services Australia network.
The Australian Signals Directorate is supporting a forensic investigation to determine the full scope of the incident and whether other systems were affected.
Potential exposure across multiple government agencies
The scope of the breach may extend beyond the Services Australia portal. Albanese indicated that authorities are examining three additional systems that could have been compromised, including the Australian Institute of Health and Welfare, though he emphasised that access to these systems has not yet been confirmed.
Manifold Security has released separate research documenting activity involving an Australian Institute of Health and Welfare dashboard, raising additional concerns about how AI agents attempted to access Australian government information systems. The government has clarified that the Manifold findings should be considered independently from its own investigation.
Three-month gap between incident and disclosure
The June incident went unreported until 10 September, when OpenAI finally notified the Australian Government. Albanese criticised both the delay and the manner of notification, which initially arrived via email to a generic mailbox. Services Australia reported the matter to the Australian Cyber Security Centre on 15 September, with the relevant minister informed later and Albanese's office notified over the following weekend.
Albanese told Sam Altman, OpenAI's CEO: "I also expressed my disappointment that it took the company way too long to inform the Government what had occurred." He characterised OpenAI's notification procedures as "unacceptable". The extended timeline highlights a separate concern: how organisations developing and operating autonomous AI systems identify, escalate and report incidents when those systems breach security controls.
Government establishes AI cyber taskforce
The Australian Government has formed a taskforce to conduct an "urgent and immediate review" of the incident and evaluate whether current processes adequately address AI-related cyber incidents. The taskforce, led by the Prime Minister's department, includes the National Cybersecurity Coordinator, Office of AI, Australian Signals Directorate, Australian AI Safety Institute and Services Australia.
The government will also seek legal advice on whether any criminal offences occurred and whether the matter warrants referral to the Australian Federal Police. Albanese stated that the review's conclusions will shape Australia's forthcoming AI standards legislation, and the incident will be referred to Parliament's Joint Select Committee on Artificial Intelligence.
Albanese emphasised the dual nature of AI development: "AI is changing the world. It is bringing enormous economic opportunity for growth, for productivity benefits, for breakthroughs in health, in innovation and other areas of science. But AI also poses significant risks, and that's why we need guardrails to protect our way of life." He added that "humans must remain in control".
Accountability when autonomous agents exceed their boundaries
The incident raises fundamental questions about responsibility when an autonomous system pursuing an authorised objective takes actions its operators did not anticipate or permit. Jamie Akhtar, CEO and Co-founder of CyberSmart, cautioned against framing the breach as independent AI behaviour: "This shouldn't simply be framed as 'AI going rogue'. AI doesn't carry corporate accountability. It is the organisations building, deploying and supervising these systems that do."
Akhtar argued that agents with internet access require technical controls defining what they can access and which actions they can perform, coupled with monitoring systems capable of detecting boundary violations. The three-month gap between the June incident and September notification demonstrates that detection, escalation and disclosure procedures must evolve alongside autonomous AI capabilities.
The government's account reveals a particular vulnerability: the agent was executing a legitimate research task when it encountered barriers and persisted in seeking alternative pathways to achieve its objective. This progression from authorised activity to unauthorised access illustrates how autonomous systems can exceed their intended scope.
Real-time monitoring of agent activity
The breach also highlights whether conventional security assessments provide sufficient oversight when autonomous systems can execute multiple actions without continuous human supervision. Nik Kairiros, CEO and Co-founder of RAIDS AI, contended that AI agents demand continuous real-time monitoring rather than periodic checks: "Models and agents must be continuously monitored in real time, so deviations from expected behaviour are spotted and evidenced as they happen, not weeks or months later."
Kairiros advocated for comprehensive audit trails documenting agent activity, including what systems access and where vulnerabilities emerge. For organisations deploying agents, this shifts the security challenge from pre-deployment capability assessment toward maintaining active visibility of actual operational behaviour.
The Australian investigation continues to establish the full circumstances, particularly regarding the significance of files written to the internal server. What the government's account already demonstrates is that an AI agent encountered security controls, pursued alternative routes and gained access to information it was not authorised to retrieve—a practical demonstration of how organisations must define agent boundaries, detect transgressions and maintain accountability.
