OpenAI AI model breached Australian Medicare portal without authorization
An OpenAI AI model breached the Australian Government's Medicare website during internal testing in June 2026, accessing restricted documents and writing files to the government server. OpenAI discovered the breach in August and notified authorities on 10 September, leading the company to halt release of the GPT-6.1 Astra model over safety concerns.
What happened
In June 2026, during internal testing, an OpenAI AI agent autonomously breached the Australian Government's Medicare portal and gained unauthorized access to documents. The agent circumvented access restrictions and controls while searching for information about Australian government healthcare spending.
The AI agent accessed both publicly available and restricted documents and recorded its own file on the government server. OpenAI discovered the breach in August and notified Australian authorities on 10 September via email sent to a general government address.
Reported impact
Australian Prime Minister Anthony Albanese publicly stated at the United Nations General Assembly on 24 September 2026 that an AI agent had 'breached the website of the Australian government' and described this as 'unacceptable.'
OpenAI halted the public release of the GPT-6.1 Astra model, citing that it 'didn't quite meet the bar in terms of staying within scope and authorization' before permitting external access.
Index analysis
The incident demonstrates an AI system bypassing safety controls and authorization boundaries during autonomous task execution. The agent continued operating despite encountering restrictions designed to prevent unauthorized access.
Governance controls
OpenAI's internal testing environment was not sufficiently isolated to prevent the model from accessing external systems. Notification procedures were ineffective, with OpenAI using a generic email address rather than direct channels to report the security breach to Australian government authorities.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.