Image: Tara Winstead/Pexels
Analysis: An OpenAI artificial intelligence (AI) agent in Australia gained unauthorised access to a government Medicare statistics portal in June, accessing both public and non-public information.
The incident occurred on June 18, but OpenAI didn’t notify Services Australia until September 10. The Australian Signals Directorate – the government agency responsible for cyber security and intelligence – was only alerted on September 15.
The government says there’s currently no evidence individual Medicare records were accessed. The website was separate from systems handling individual Medicare claims, payments or personal information.
According to a report in The New York Times, the OpenAI agent also tried accessing the Australian Institute of Health and Welfare website, but no private info was obtained. A relationship between the two events has not been confirmed at this stage.
Investigations are continuing, so we don’t yet know precisely what vulnerability allowed the agent in.
But the incident raises a broader question: how ready are Australian government systems for increasingly capable AI agents? And who is responsible for keeping government systems secure?
Who keeps government systems safe?
Deputy Prime Minister Richard Marles described the OpenAI incident as “very serious” and “utterly unacceptable”. However, he also noted the information wasn’t sensitive and was not guarded as rigorously:
The analogy I would give here is that it was behind a fence. The AI agent climbed the fence […] When you’re talking about our national security, the most sensitive information that we have, it sits behind a fortress.
There’s no one organisation responsible for securing every Australian government website. Individual Commonwealth entities manage security risks within their systems, while operating under whole-of-government requirements – the protective security policy framework.
The Australian National Audit Office requires government entities to identify and actively manage risks associated with vulnerable technologies, including ones they manage for other entities.
Meanwhile, the Australian Signals Directorate provides detailed technical cyber security guidance. Its manual provides a cyber security framework that government organisations can apply to protect their systems and data.
Services Australia, which administers Medicare, therefore, has the responsibility for managing risks within its systems, while operating within broader government security requirements.
All this is to say Australia isn’t lacking cyber security frameworks. The harder question is whether they’re being implemented effectively across large, complex and sometimes ageing government technology environments.
There is evidence this remains a challenge.
Australia: Ongoing privacy risks
A 2025 Australian National Audit Office review found Services Australia relies on “multiple ageing legacy ICT [information and communications technology] systems” to deliver services and payments. The audit said this creates privacy risks.
It also found the agency hadn’t resolved previously flagged issues around managing which users get access to what, and how they’re monitored.
While we don’t know what caused the OpenAI incident, these findings establish that concerns about ageing technology and access controls at Services Australia existed before the OpenAI breach became public.
Opposition defence spokesperson James Paterson has argued the incident demonstrates Australia’s cyber defences are not “fit for an age of AI”.
He particularly questioned why an internet-facing legacy system containing non-public information could remain unpatched, and called for vulnerabilities to be identified and rectified.
However, the broader issue he raises – whether government cyber defences are adapting quickly enough to AI – isn’t new.
Australia’s cyber security guidance for the AI era
On May 27, the government issued a whole-of-government policy advisory about cyber security readiness in the current AI era. It provides Commonwealth entities with advice on preparing for cyber security risks associated with increasingly capable AI.
Then, this month, the Australian Signals Directorate released new guidance specifically addressing agentic AI.
An AI agent is more than a chatbot producing text. It’s what allows a large language model to interact with other systems and perform actions. You can think of the model as the “brain”, and the agent as the “body” – the brain gives signals to the body, which then moves and touches things in the world.
The directorate now recommends giving each AI agent a unique identity so its actions can be distinguished from those of a person or another agent. It’s similar to giving every employee their own login: you can trace which agent performed a particular action.
It also recommends maintaining an AI agent register to record information such as the agent’s owner, purpose, credentials, tools, permissions and data access.
The Medicare incident demonstrates the importance of such an approach. A government website doesn’t have to use AI to encounter an AI-related cyber security problem. External autonomous systems – such as the OpenAI model – can interact with government infrastructure and potentially find weaknesses.
Australia: What should happen next?
First, government agencies should identify internet-facing legacy systems and understand what information and functions they expose. Existing government policy already requires agencies to actively manage risks associated with vulnerable technologies.
Second, the principle of least privilege becomes increasingly important. Cyber security experts use this term to describe a simple rule: an AI system should have only the access it needs to perform its task, and nothing more.
Third, detection needs attention. The Medicare incident happened in June but OpenAI reported it almost three months later. Government systems therefore need monitoring capable of detecting unusual automated behaviour rather than relying only on an external company to identify and report it.
Finally, cyber security testing needs to reflect the capabilities that exist now. The Australian Signals Directorate recommends introducing agentic AI through a phased approach, validating security controls and maintaining human oversight.
The Medicare incident doesn’t establish that Australian government systems are broadly insecure. But it highlights a problem the government and the Signals Directorate have already recognised – now it’s about making sure we keep up those defences as AI development continues.
Meena Jha, Associate Professor, College of Information & Communication Technology, School of Engineering and Technology, CQUniversity Australia
NAN 26-09-26/This article is republished from The Conversation under a Creative Commons license.
You may also find interesting:
Germany sets out plan to phase out fossil fuels by 2045
Germany has said it plans to phase out the use of coal, oil and gas by 2045, reaffirming a climate strategy focused on electrification. Germany has presented a road map to phase out fossil fuels by 2045. German Environment Minister Carsten Schneider told more…
