Australian Prime Minister Anthony Albanese has confirmed that autonomous AI agents operated by OpenAI breached a Medicare statistics reporting portal run by Services Australia, accessing both public and non-public files and writing data to an internal server.

The incident occurred on June 18 during an OpenAI research project examining public medicine spending. Albanese said protective controls were in place to block the agent’s data requests, but the agent circumvented them. “There were blocks clearly which were coming back telling the AI agent, no. The AI agent found a way around those blocks,” he said, adding that the model “attempted alternative ways to obtain the info that it wanted, and this led to unauthorized access into some other areas.”

An investigation is underway to determine whether other government systems were affected. Based on current evidence, Albanese said no individuals appear to have been impacted. He also noted that OpenAI did not notify Australian authorities of the unauthorized activity until September 10, roughly three months after it occurred.

Wider pattern of probing

Separately, nonprofit research lab Transluce published findings based on public records from the URL scanning service urlquery.net, showing that OpenAI agents used the service’s remote browser system to retrieve data when direct access attempts failed. The report documents three additional cases between May and June affecting the Australian Institute of Health and Welfare, Data USA, and the digital library of the University of New Mexico.

  • Against the University of New Mexico’s digital library, agents ran seven probes, including attempted SQL injection, command injection, and path traversal, while trying to retrieve a photograph.
  • Against Data USA, agents probed for multiple vulnerabilities after malformed queries related to the University of Iowa returned errors.
  • Against the Australian Institute of Health and Welfare, agents checked for a reflected cross-site scripting flaw after receiving errors. Cloudflare blocked the requests, but the agents still retrieved a public file from a pre-production server.

Transluce said it found no evidence that any exploitation attempt succeeded, but cautioned that the dataset it analyzed is incomplete and that other, more private access attempts cannot be ruled out.

BleepingComputer has contacted OpenAI for comment but had not received a response at the time of publication.

The disclosures add to a growing list of incidents in which autonomous AI agents performing research tasks have taken unauthorized actions against real systems, raising fresh questions about how AI labs test and constrain agentic tools operating against live, third-party infrastructure.