An OpenAI artificial intelligence agent, that is, a computer program based on algorithms that carries out tasks on its own without a human watching over it, got around the blocks on the statistics portal of Medicare, Australia’s public health system, and accessed the agency’s non-public files, including information that was never meant to be released.
The country’s prime minister, Anthony Albanese, revealed the incident at the UN General Assembly, where he denounced nearly three months of silence from Sam Altman and the company OpenAI, turning the episode into a banner for the regulatory agenda he has been leading on the global stage.
When Agents Take On a Life of Their Own
By: Gabriel E. Levy B.
On June 18, 2026, an OpenAI agent researching public spending on medicines, a very common routine for this kind of algorithm and one that should be limited to consulting public information only, entered the Medicare Statistics Reporting Service, a portal run by Services Australia, the agency that operates the country’s universal health system.
The system returned several block messages; the agent tried alternative routes until it reached both the public and the non-public files, and according to the agency it also wrote files to an internal server, although what exactly it wrote has not been made public, since, as Australian authorities reported, that point remains under investigation.
“Today I spoke with the CEO of OpenAI, Sam Altman, to express Australia’s extreme concern about this incident; and I also expressed my disappointment that it took the company way too long to inform the Government what had occurred, and the nature of the way that notification occurred as well was unacceptable”,
Anthony Albanese, Prime Minister of Australia, speaking to reporters in New York.
OpenAI detected the activity on August 11, during an internal review of what the company itself describes as misaligned behavior by its models, that is, when an algorithm makes unexpected decisions or steps outside the limits the company authorized; but, although it had known since August, only on September 10 did it send an email to a public Services Australia inbox, an address that researchers and academics use to report vulnerabilities and that nobody monitors around the clock, reporting, without much detail or data, what it had found about events that happened months earlier.
Albanese learned the details on September 23, in the middle of the United Nations General Assembly, and the next day he called Sam Altman, OpenAI’s chief executive, to convey his government’s “extreme concern” and to call the delay unacceptable.
“Our models took actions we did not intend”, OpenAI acknowledged in a statement; the company said it found no evidence that individual medical records were accessed.
The compromised data consists of aggregate statistics on system usage and costs, not patient records; that difference explains why the government could disclose the breach without exposing itself to a crisis of public confidence; even so, this is sensitive data that sat not far from patients’ clinical information, which means one can infer, from what is publicly known, that, had it wanted to, the agent could easily have reached the medical records; however, Australian authorities have neither confirmed nor denied that possibility.
A Chain of Incidents
The Australian case joins a series of episodes in which OpenAI agents acted outside what was planned and entirely on their own, perhaps the most striking being the one in July, the month in which, during cybersecurity tests, its models created a swarm of agents that entered the systems of Hugging Face, the platform where the community publishes AI models, while other reports link its agents to the tampering of a German wiki and the mass publication of malicious packages on RubyGems, the software repository for the Ruby language, in a coordinated action that could easily be mistaken for a Russian hacker attack.
Hammond Pearce, a professor at the University of New South Wales Institute for Cyber Security, told the BBC, in an article the British public broadcaster published recently, that this is the first known case of AI agents deciding on their own to breach a government body, and he warned it will not be the last, because the more intelligent the algorithmic systems we build, the higher the probability that they make critical decisions on their own and, when faced with the security barriers websites put up, they will always look for alternatives to complete their mission.
The pattern repeats in the way the news comes out: OpenAI reports this behavior weeks or months after it happens, and it does so through channels that do not guarantee the affected party gets the alert in time.
Other major players in the market for so-called artificial intelligence, such as Anthropic, Google and Meta, have also reported unauthorized access by their agents to external systems, which points to a structural problem in this generation of autonomous systems; and although every report comes from the West, it is impossible to rule out Chinese systems, which are very likely going through the same processes, with the difference that that country’s government most likely forbids its companies from publishing these episodes, so that our democracies end up creating the perception that this is a Western problem, when in reality it is a technological problem, one exposed only by companies in these latitudes given China’s lack of transparency.
Canberra’s Political Play
Beyond the technical damage, the timing chosen for the announcement has an obvious political dimension.
Australia, a middle power that rarely makes global headlines, has spent a year building a reputation as the toughest regulator of Big Tech: it passed a ban on social media for children under 16, announced algorithm controls it describes as the strictest in the world and proposed limits for devices such as smart glasses.
Alastair MacGibbon, a former cybersecurity adviser to the Australian government, told the BBC he had heard rumors of similar notifications to other parties; “Some have chosen not to make it public”, he said, and he noted that each government decides how to handle these incidents.
Tama Leaver, a professor of internet studies at Curtin University, believes everything points to careful planning, with world leaders gathered in New York as the ideal stage to maximize the announcement’s visibility.
“Nobody has died”, said Michael Noetel, an associate professor at the University of Queensland, for whom the episode is another warning sign about loss-of-control incidents that, although limited today, worry industry executives themselves because they fear things will get worse over time.
Hours after the announcement, Communications Minister Anika Wells said the case portrays an unregulated industry in which:
“big tech clearly thinks it can do whatever it wants”.
The New York press revealed that, after the call with Altman, OpenAI apologized to Australians and promised resources to strengthen the country’s cyber defenses, a local task force staffed with national experts and mandatory reporting procedures for future incidents.
What Should Latin America Learn From This Case?
The episode leaves clear, concrete lessons for the governments of the region and, more broadly, of the Global South, the main one being that they are digitizing public services at high speed while, at the same time, opening their portals to any program capable of browsing the web.
On another front, the first lesson is that a software block is not the same as a physical barrier; an autonomous agent reads a “no” as an obstacle to get around, and state portals for open data, health, education or procurement were rarely designed with visitors in mind that reason, retry and change strategy to get in, all the more so because most cybersecurity strategies were devised for humans whose mother tongue is not the language of machines, a variable that completely changes the computing capabilities of an algorithmic attacker.
The second is the need for mandatory notification channels: in Australia the alert landed in a generic inbox and went astray for almost two weeks; no Latin American country today has a legal procedure that obliges AI developers to report, within set deadlines, the unplanned actions of their systems on public infrastructure; in other words, an attack on a public server in Bolivia, Ecuador or Panama would have nowhere to be reported by OpenAI or Google.
The third has to do with the asymmetry of power: Australia was able to call OpenAI’s chief executive and obtain an apology, financial support and a promise of a local response; by contrast, a ministry in a small country would hardly get the same attention, in fact, hardly anyone at OpenAI would take its call, unless the region negotiates common standards through bodies such as ECLAC or the OAS, organizations divided from within that the extremist political forces governing the region have been systematically weakening through rhetoric that discredits multilateralism.
The fourth is organizational: Australia set up a task force led by the prime minister’s office, with the Signals Directorate (its communications intelligence agency) and the AI Safety Institute, to review whether current cybersecurity protocols hold up when the intruder is an autonomous system and not an attacker chasing a payoff.
That question still has no answer in Bogotá, Mexico City or Buenos Aires, and the clock is ticking at the pace of each new generation of AI agents.
In summary: an OpenAI agent got around the blocks on Medicare’s statistics portal, accessed non-public files, and the company took nearly three months to notify Australia through an email to a generic inbox; Prime Minister Albanese disclosed the case at the UN, confronted Sam Altman and turned it into an argument for his regulatory agenda. The episode confirms that autonomous agents are already acting on state infrastructure and that governments, Latin American ones included, lack the protocols to deal with them.
References
Albanese, A. (2026, September 24). Press conference – New York [Transcript]. Prime Minister of Australia. https://www.pm.gov.au/media/press-conference-new-york
BBC News Mundo. (2026, September). Australia revela que agentes de IA “fuera de control” se infiltraron en un organismo gubernamental: por qué el momento del anuncio también es político. BBC News Mundo.
Cyprus Mail and Reuters. (2026, September 24). OpenAI agent hacks Australian government health portal. https://cyprus-mail.com/2026/09/24/openai-agent-hacks-australian-government-health-portal
Jang and AFP. (2026, September). Australia reveals OpenAI agent hacked Medicare portal, sparking “extreme concern”. https://jang.com.pk/en/73752-australia-reveals-openai-agent-hacked-medicare-portal-sparking-extreme-concern-news
The New Daily. (2026, September 29). OpenAI apologises to Australians for Medicare hack. https://www.thenewdaily.com.au/life/tech/2026/09/29/openai-apologise-medicare
The Next Web. (2026, September). OpenAI agent broke into Australia’s Medicare statistics portal, PM says. https://thenextweb.com/news/openai-agent-medicare-statistics-portal-australia
To Vima. (2026, September). Rogue OpenAI agent hacked Australian government site in June. https://www.tovima.com/world/rogue-openai-agent-hacked-australian-government-site-in-june/
Verdict. (2026, September). Australia investigates OpenAI agent access to Medicare statistics portal. https://www.verdict.co.uk/?p=403990
