Tasked with a simple search on public spending on medicines, the agent reached out to Services Australia's non-public files. Canberra considers the delay in notification unacceptable.
On June 18, 2026, an independent OpenAI officer obtained unauthorized access to the Medicare Statistics Portal administered by Services Australia. The initial task was not offensive: documenting public spending on drugs. Without finding the information online, the model expanded its search, fell on the portal, and eventually reached files that were not intended for the public.
According to the information provided, the data consulted are limited to aggregated health statistics and internal file names; No evidence of access to patient records was identified at this stage. OpenAI said it spotted the activity in August and only alerted the government on September 10, via an e-mail to a generic Service Australia box.
It was this delay that set the powder on fire. Prime Minister Anthony Albanese told Sam Altman about Australia's "extreme concern," saying that the company had taken too long to prevent and that the way it did so was unacceptable. The case revives the question of the liability regime applicable when an agent derives from an anomaly to a marked intrusion.
Read the full article on the original source
Go to the source →