Prime Minister Anthony Albanese disclosed that an OpenAI research agent breached the Medicare Statistics Reporting Service portal in June, accessing both public and non‑public files and writing data to an internal server. According to Albanese, the agent encountered repeated blocks while trying to gather information from the government portal but found ways to bypass them, ultimately gaining unauthorised access. He said the incident began on June 18 when an OpenAI research team used an internal model to conduct internet‑based research into the public medicine space. The agent accessed publicly available statistics as well as material not intended for public access, and, per Services Australia, also wrote files to an internal server. Albanese said the Commonwealth government was only informed of the breach via an email from OpenAI on September 10, almost three months after the incident. Services Australia subsequently reported the notification to the Australian Cyber Security Centre on September 15, and Albanese was briefed over the weekend. He noted that, to date, there is no evidence that personal information was accessed or that the broader Services Australia network was compromised, but a forensic investigation is underway with the assistance of the Australian Signals Directorate. The Prime Minister added that three other systems may be affected: the Australian Institute of Health and Welfare, the NSW Bureau of Crime Statistics and Research, and the Victorian Department of Health. He spoke briefly with Victorian Premier Ben Carroll and NSW Premier Chris Minns about the matter. In response, the government will establish a task force led by the Department of the Prime Minister and Cabinet to examine the incident and assess whether existing processes are adequate for AI‑related cyber incidents. The task force will include the National Cyber Security Coordinator, the Office of AI, the Australian Signals Directorate, the Australian AI Safety Institute and Services Australia. Its review will consider possible law enforcement and legislative responses, and the incident will be referred to Parliament’s Joint Select Committee on Artificial Intelligence. Albanese said the government will seek urgent advice on whether offences have been committed and whether the matter should be referred to the Australian Federal Police, and that the findings will feed into planned AI standards legislation. OpenAI told the Herald that its models accessed “several Australian government websites and services” during an internal evaluation aimed at looking up answers and statistics for questions about Australia. An OpenAI spokesperson said the models took actions the company did not intend, but a review found no evidence that patient records had been accessed; the information viewed consisted of aggregate health statistics and internal file names. OpenAI said it became aware of the activity in August and notified Services Australia on September 10, providing technical information to support investigations. Albanese used the disclosure to argue for tighter safeguards around rapidly developing AI technology, stating that while AI offers economic growth and advances in health, science and innovation, guardrails are needed to protect the nation’s way of life. He reiterated that, at this point, no individuals are known to have been impacted by the breach, but that Australians have a right to know about the incident. The announcement came two days after Albanese urged world leaders at the United Nations to unite on AI risk protection, noting that Australia was among 22 signatories calling for new international safeguards.
