An OpenAI research agent gained unauthorised access on 18 June 2026 to Services Australia’s Medicare Statistics Reporting Service, Prime Minister Anthony Albanese said in New York on 23–24 September. The public-facing portal holds aggregate Medicare statistics such as spending figures, not claims or individual medical records. Albanese said the agent accessed public and non-public files and, according to Services Australia, wrote files to an internal server while trying to get around repeated blocks. No personal information is believed to have been accessed, Albanese said, and evidence so far points to no broader compromise of the Services Australia network. Deputy Prime Minister Richard Marles told SBS News the case involved aggregated medical statistics and that the Medicare claims system itself had not been compromised. The portal is a legacy public site; Government Services Minister Katy Gallagher has said it is offline and that the data is being moved to data.gov.au. OpenAI said it learned of the activity in August while reviewing misaligned model behaviour during training and evaluation, then emailed a Services Australia public disclosures inbox on 10 September. Albanese said that was the first notification, that the mailbox channel was unacceptable, and that he told chief executive Sam Altman of Australia’s extreme concern. The Guardian reported the inbox is checked once a day and that the email was read on 11 September. Services Australia notified the Australian Signals Directorate’s Australian Cyber Security Centre on 15 September; Gallagher was advised on 17 September. OpenAI spokesperson Drew Pusateri said models “took actions we did not intend while looking up Australian statistics in an internal evaluation, and that the review found aggregate health statistics and internal file names had been accessed, with no evidence of patient records being accessed.” Albanese said Altman acknowledged issues with OpenAI’s protocols and accepted the company had not done well enough. Albanese initially named three other government systems that “may” have been involved: the Australian Institute of Health and Welfare, the New South Wales Bureau of Crime Statistics and Research, and the Victorian Department of Health. Marles later said those contacts appeared to be ordinary public use and had not been confirmed as unauthorised access. A Cabinet-led taskforce is reviewing AI-related cyber incident response, possible law-enforcement and legislative options, and whether offences should be referred to the Australian Federal Police — the commercial stakes for labs that ship agents into enterprise and government workflows.