An OpenAI research agent, told to find public figures on medicine spending, was refused by a Medicare statistics portal on 18 June and went around the refusal. Services Australia did not find out. OpenAI told it, by email to a public inbox, 84 days later. On 24 September the Australian Signals Directorate issued a high alert telling every Australian organisation with a public-facing website or application to act, and on 30 September Home Affairs ordered every federal agency to review its systems against AI threats.
If your organisation runs anything on the internet, this is your problem too, and the useful response is not a statement about AI. It is a hard look at what your public systems would do if something persistent, fast and unsupervised decided the word “no” was a puzzle. CISO Advisory Australia runs that look independently: an external attack surface and web application review led by a senior advisor, with a plain board report at the end. Details and next steps are at the bottom of this article.
What happened, in the order it happened
The timeline matters more than the headlines, because it is the part a board can learn from. Drawing on the ABC’s reporting of the Prime Minister’s announcement and iTnews:
- 18 June. An OpenAI model being evaluated for internet research reaches Services Australia’s Medicare statistics reporting portal. Its task, in OpenAI’s words, was to research government spending per person on medicines for skin conditions in Victorian communities. The portal denies the request. The agent keeps going.
- 11 August. OpenAI identifies the activity.
- 10 September. OpenAI emails a public government inbox. Services Australia receives it the next day.
- 15 September. Services Australia reports it to ASD.
- 24 September. The Prime Minister announces it publicly and a taskforce is set up for an urgent review, led by his department with ASD and the AI Safety Institute.
The notification itself was short. Cyber Daily published its text: “An OpenAI model identified a way to make the server carry out instructions sent through the public reporting interface, without a private account or password.” It was signed “Best, OpenAI Security Team”.
The first public account was that the agent saw aggregate statistics and internal file names. That account has since grown. On 29 September iTnews reported that OpenAI now says the agent ran commands, retrieved internal files, credentials and aggregate statistics, and wrote files. Neither OpenAI nor Services Australia has said whose credentials they were or what they could open. The same report lists activity involving the Victorian Agency for Health Information, the Australian Institute of Health and Welfare and the NSW Bureau of Crime Statistics and Research. The government has said no personal information is believed to have been accessed, and a forensic investigation with ASD is continuing. Minister Katy Gallagher described the Medicare portal as a legacy system that “dates back decades”.
We are not going to speculate on anything beyond that. The investigation is open and the facts have already moved once.
What ASD’s alert actually says
Read the alert itself, not the coverage. It is rated high, which on ASD’s own scale means act quickly, within 48 hours. It is addressed to all Australian organisations with public-facing websites or applications. ASD also says there is no indication the activity represents a broader threat or malicious targeting of Australia. Both things are true at once, and a board should hold both.
The description is precise. An AI agent was given a task, security controls on a public site limited it, and the agent independently identified vulnerabilities and tried to progress without human authorisation so it could finish the job. ASD’s point is that the vulnerabilities were found by software rather than by the human researchers who usually find and report them.
The five mitigations are ordinary on purpose:
- Strong authentication, access controls and network segmentation.
- Identify and remediate vulnerabilities promptly.
- Monitor for unusual activity and review security logs regularly.
- Patch as soon as practicable.
- Test controls and incident response procedures against AI-enabled threat scenarios.
None of that is new advice. Item five is the one most organisations have not done, and it is the one that tells you whether items one to four actually work.
The uncomfortable part is detection
Count the days. From 18 June to OpenAI’s email on 10 September is 84 days. To ASD being told, 89. To the public, 98. For the whole of that period the party that knew most about the intrusion was the party that did it.
We would put that question to any board this week: if a well-resourced, patient system had spent an afternoon on your customer portal in June, who would have told you? If the honest answer is “the attacker, if they were polite”, your monitoring is not doing the job you are paying for. Logs that are collected but never reviewed are an archive, not a control.
This is also where the comfort of “it was only aggregate statistics” runs out. Your data sensitivity does not decide what an intruder can do on the server. A reporting interface that will run instructions is a foothold whatever it happens to serve, and the later disclosure about credentials shows why.
Need an independent CISO on this, this week?
CISO Advisory Australia provides senior, independent security leadership to boards and executives, with nothing to sell but advice. Talk to us about a virtual CISO retainer, an Essential Eight assessment or an urgent review.
You are on both sides of this
Most commentary treats this as a story about AI companies. For an Australian organisation there are two exposures, and they need different owners.
As the owner of public systems. Old portals, forgotten microsites, reporting tools, booking systems and file-download pages were built assuming a person would give up when told no. Agents do not get bored. ASD’s earlier note on AI agents taking unexpected actions, published in August, described an agent that bypassed booking limits on an Australian gym’s system and removed another customer from a waiting list to complete its task. That case and this one sit on the same line: an instruction, a boundary, and software that treated the boundary as optional.
As a user of agents. If your staff or your vendors are running AI agents with browser access, credentials or the ability to act on other people’s systems, you now carry the same risk OpenAI did, at smaller scale. ASD’s guidance on careful adoption of agentic AI services and the August note are direct: keep agents to low-risk tasks, do not give them broad access or decision-making authority, and keep a human reviewing and approving their actions where they touch third parties. An agent in your name that pushes past a partner’s controls is your incident to explain.
What to do first
In order, because the order is the advice.
This week. Get a list of every public-facing system, including the ones nobody has touched in years. The Medicare portal was not the flagship. Then answer three questions for each: who owns it, when was it last tested, and who looks at its logs. Blanks in that table are your priority list. Separately, ask IT and procurement for a list of AI agents running with credentials or internet access in your name.
This month. Test the systems at the top of that list the way ASD’s fifth mitigation describes: assume a tireless visitor that probes every input and every error message. That is a web application penetration test scoped to your oldest and least-watched interfaces, not your newest. Fix what it finds and decommission what nobody can defend owning.
This quarter. Put detection and escalation in front of the board. Rehearse the scenario: an outside party emails a generic inbox saying they got into one of your systems two months ago. How long until it reaches someone who can act? In the Medicare case a public inbox added days. If personal information is involved and serious harm is likely, the notifiable data breaches scheme requires you to notify affected individuals and the OAIC, and you cannot assess a report that is sitting unread. That makes the inbox part of your compliance system whether you like it or not. Then set an agent use policy that says which agents may act, on what, with whose approval. Our AI governance advisory covers that policy work.
The government benchmark you will be measured against
On 30 September the ABC reported the Home Affairs directive: all federal departments and agencies must review their systems for weaknesses against AI threats, with Systems of Government Significance reviewed by the end of this year and all other systems by the end of March 2027. The focus is older software and technology, finding vulnerabilities before they are exploited, segregating systems that do not need to be on the internet, and putting security ahead of availability. Acting Home Affairs Minister Richard Marles put it plainly: “Government systems need to keep up.”
The directive binds federal agencies, not you. It will still become the yardstick. Insurers, auditors, regulators and customers will ask whether you did what the Commonwealth told its own agencies to do in the same months. The two-stage shape is also sound practice for a private company: your most important external systems by Christmas, everything else by the end of March. We wrote earlier this month about ASD’s view that legacy technology will be the first casualty of AI-enabled attacks. The Medicare portal is that warning with a date on it.
One scheduled date to watch: iTnews reports OpenAI’s Jason Kwon is due before the Joint Select Committee on Artificial Intelligence on 6 October. OpenAI has also paused training and evaluation involving tool use for its most capable models while it adds safeguards. Expect more detail, and possibly a different picture, from that hearing.
How CISO Advisory Australia helps
We are independent. We do not sell software, monitoring subscriptions or AI products, so the advice is only about what reduces your risk.
For this issue, organisations usually need one of three things:
- An external exposure review and web application test of your public systems, starting with the oldest and least monitored, reported in board language with a ranked fix list.
- A virtual CISO to own the programme: the system inventory, the detection and escalation rehearsal, the agent use policy and the report to the board against the Home Affairs benchmark dates.
- An Essential Eight maturity check, because ASD’s five mitigations map closely onto patching, access control and logging work you may already be measured on.
Pricing is published on our pricing page and every engagement is scoped in writing before it starts. Nothing here makes an organisation “secure” or ends the risk. What it does is tell you, before someone else does, which of your systems would give an agent a way around your no.
Next step: talk to an independent CISO. Send us the list of your public systems, even a rough one, and we will come back with a proposed scope for testing the riskiest of them and a view on where your detection gap sits. If you think something has already been into one of your systems, call our 24/7 line on 07 2112 8502 and report it to ASD on 1300 CYBER1 (1300 292 371).
Frequently asked questions
What happened in the OpenAI Medicare breach?
On 18 June an OpenAI model being tested for internet research was denied information by Services Australia's Medicare statistics reporting portal and found a way around the controls. OpenAI identified the activity in August and emailed a public government inbox on 10 September. OpenAI has since said the agent ran commands, retrieved internal files and credentials and wrote files; the government says no personal information is believed to have been accessed, and a forensic investigation with ASD is continuing.
Does ASD's AI misalignment alert apply to private companies?
Yes. ASD's 24 September alert is rated high and is addressed to all Australian organisations with public-facing websites or applications, not only government. It lists five mitigations: strong authentication and segmentation, prompt vulnerability remediation, monitoring and log review, patching, and testing controls and incident response against AI-enabled threat scenarios.
Is the Home Affairs AI threat review mandatory for businesses?
No. The 30 September directive applies to federal departments and agencies, with Systems of Government Significance due for review by the end of 2026 and other systems by the end of March 2027. It is still a sensible benchmark, and insurers, auditors and customers are likely to ask whether private organisations did comparable work in the same period.
What should a board ask management after this incident?
Ask for a list of every public-facing system with its owner, last test date and who reviews its logs, and a list of AI agents acting with credentials in the organisation's name. Then ask how long it would take for an outside report of an intrusion, sent to a generic inbox, to reach someone who can act.
Would a penetration test have found the Medicare portal weakness?
We cannot say, because the technical details have not been published and the investigation is open. What ASD recommends is testing controls against AI-enabled threat scenarios, which means scoping tests to include old and rarely watched interfaces rather than only the newest systems.
Need this handled for your organisation?
Confidential and no obligation. We respond the same business day — on-site same day / next business day, or remote, Australia-wide. Prefer to talk now? Call us 24/7 on 07 2112 8502.