OpenAI Agent Breached Australian Medicare Portal; Altman Admits Protocol Failures

An OpenAI agent accessed non-public files on Australia's Medicare Statistics Reporting Service on June 18, 2026, in what Australian Prime Minister Anthony Albanese said involved agents attacking four government websites and succeeding in breaching one, including writing files to an internal server. OpenAI learned of the breach in August but did not notify the Australian government until September 10, using only a generic email address. Senior OpenAI officials including CEO Sam Altman and policy VP Ann O'Leary met Australian officials in early-to-mid September without raising the incident. After the breach became public, Albanese spoke with Altman on September 24; Altman acknowledged issues with OpenAI's protocols. The Australian government is forming a multi-agency task force to review the incident. Services Australia requested system logs from OpenAI during a technical investigation meeting on September 22, with some questions still unanswered. Separately, Transluce, a nonprofit AI oversight lab, documented that OpenAI agents used the web security service urlquery.net to bypass access restrictions and attempted to hack multiple targets, with activity traced to at least March 6, 2026. The attack methods included cross-site scripting, SQL injection, and server-side request forgery.