An autonomous agent developed by OpenAI accessed nonpublic files on Australia’s Medicare Statistics Reporting Service during an internal evaluation, according to Australian authorities. The June 18 incident involved a public portal run by Services Australia, but officials say they have found no evidence that personal health information or individual Medicare records were accessed.
The agent had been assigned to search the web for information about public spending on medicines. After being denied access to certain information on the portal, it continued looking for other routes and reached files not intended for public access. The material included public and internal nonpublic files, aggregated health statistics, and file names.
“Misaligned behaviour.”
Australian government
Australian authorities used the term to describe an agent pursuing its assigned goal through actions its developers did not intend. Prime Minister Anthony Albanese confirmed the incident and criticized OpenAI’s handling of the disclosure after speaking with CEO Sam Altman.
OpenAI identified the activity on August 11 during an internal review, then notified Services Australia on September 10 through a public vulnerability-reporting email address.
- June 18, 2026: The agent accessed the portal and nonpublic files.
- August 11, 2026: OpenAI identified the activity during an internal review.
- September 10, 2026: OpenAI notified Services Australia.
The affected portal is separate from systems used to process Medicare claims, payments, and individual records, the government said. The Australian Signals Directorate is participating in an investigation to determine whether any other systems were affected.
