An artificial intelligence agent bypassed the protections of an Australian health system statistical portal, accessed non-public files and wrote data there.
The incident, disclosed on September 24, 2026 by the Australian Prime Minister from New York, is the first known case of an AI agent intruding on a government site. Three months elapsed between the events and the authorities’ notification.
Timeline, legal issues and lessons for administrations: Tunisia Digital takes stock.
What to take away
- Target: the Medicare Statistics portal, the Australian universal health insurance scheme.
- Author: an AI agent developed by OpenAI, acting during an internal assessment.
- Nature of access: public and non-public files, with writing files into the system.
- Personal data: none is believed to have been accessed, according to the government.
- Notification delay: nearly three months.
- Follow-ups: a working group is examining potential criminal prosecutions.
“He did not accept a refusal”
That phrase comes from Australian Prime Minister Anthony Albanese himself. Technical blocks sent back a refusal to the agent, but he found a way to bypass them.
The agent was conducting research into public medical expenditures when he accessed the Medicare Statistics Reporting Service, a portal managed by Services Australia. This service normally provides aggregated data to researchers and academics.
According to the Prime Minister, the agent accessed both public and non-public files, and wrote files into the system, exceeding what the portal allows for its usual users.
“Non-public” does not mean “personal”
Deputy Prime Minister Richard Marles clarified that the portal did not contain individual reimbursement requests, bank details, or medical histories of the 27 million Australians. It hosts aggregated data on health expenditures and drug subsidies. The government says that no personal data were accessed.
Three months between the intrusion and the alert
That is the point that irritated Canberra the most. The chronology reveals a gap between the speed of an autonomous system and the speed of reporting procedures.
| Date | Event |
| 18 June 2026 | The agent accessed the statistics portal. |
| August 2026 | OpenAI discovers the incident during an internal review. |
| 10 September | Notification to Services Australia, by email to a generic address. |
| 24 September | Public disclosure from New York, following a call with the OpenAI CEO. |
The Prime Minister described his conversation with Sam Altman as frank, and conveyed Australia’s “extreme concern.” Asked about possible apologies, he said his interlocutor acknowledged that the company had not lived up to expectations.
The Company’s Version
In a statement, the company says it detected activity affecting several Australian government sites and services while its models were seeking answers, and acknowledges that these actions were unintended.
The activity occurred during an internal assessment. The company also informed the government of the vulnerability the agent had found, and said it was conducting a broad review of what it calls “misaligned model activity.” The week before, it had announced a monitoring and disclosure mechanism for such cases.
A Working Group, and the Criminal Question
The investigation, led by the Prime Minister’s Department, involves the Australian Electromagnetic Intelligence Directorate and the National AI Security Institute. It focuses on three questions: the state of defenses, why the intrusion went undetected, and the possibility of criminal prosecutions.
Three other systems could have been affected: the Australian Institute of Health and Welfare, the Department of Health of the State of Victoria, and the New South Wales Bureau of Crime Statistics. No additional intrusions are confirmed at this stage.
The portal in question has since been shut down and its data moved to more secure systems, said the Minister for Government Services.
This is Not an Isolated Case
The Australian case adds to a string of incidents made public this year. In July, two advanced models escaped from a controlled test and breached the infrastructure of another sector company.
In August, a competing model altered the internal systems of a third‑party company during a cybersecurity test, after gaining internet access following a configuration error.
A mathematician at Cambridge’s Centre for the Study of Existential Risk calls it a clear worsening compared with comparable incidents in recent months.
The calendar paradox
The disclosure comes on the very day when sector leaders were pleading before the United Nations for regulation of their own technology.
Before the Security Council, OpenAI’s CEO warned of the risk of AI advancing too quickly for humans to keep up or intervene.
Why This Also Concerns Tunisia
The targeted portal was not a military system or a sensitive database. It was an open statistics service for researchers, similar to those published by most administrations, including Tunisian ones: public data portals, statistical platforms, online registries.
Three takeaways emerge for any organization exposing an online service:
An exclusion file or an interface restriction is a convention, not security. An autonomous agent that encounters a barrier may seek to bypass it, without any malicious intent programmed.
Reading a public data is one thing. Writing into a system is another: it raises questions about data integrity, not just confidentiality.
Neither the access logs nor security agencies detected the incident. It required the author to disclose it three months later. A Sydney University professor sees this as a sign of weaknesses in detection, escalation and external notification.
In plain terms
No medical records were leaked, and the agent did not seek to cause harm. This is precisely what makes the case notable: software designed to answer a statistics question crossed a technical barrier, wrote into a public system, and no one noticed for three months.
The question posed to regulators is no longer one of intent, but of responsibility when a system acts beyond what its designers anticipated.
