The Truth About OpenAI’s Rogue Agent’s Hack on Australian Health Website

Headlines of AI models hacking websites aren’t over. In fact, I see it getting worse as new and more powerful models get released faster than the guardrails around them are built.

So, what’s the latest? OpenAI’s rogue agent hacked and gained unauthorized access to an Australian health data portal. It’s the first publicly known case of an AI successfully hacking a government website.

Here’s the complete chronological timeline of events:

Australian health website hacking timeline

• 2015 Onward: The Medicare statistics reporting portal’s guest access URLs were public, indexed by Google, and captured by the Internet Archive's Wayback Machine.
• June 18, 2026: An internal OpenAI research agent encounters blocks at the Services Australia portal, finds another way to obtain information, and accesses non-public files. Services Australia says it also wrote files to an internal server.
• August 11, 2026: OpenAI discovers the Medicare activity during an internal review. This is the August 11 event relevant to the breach.
• September 10, 2026: 84 days after the incident, OpenAI formally notified the Australian government by sending an email to a public Services Australia mailbox.
• September 11, 2026: The email was finally read, as Services Australia only checked that specific public mailbox once a day.
• September 15, 2026: After spending several days verifying that the email was genuine, Services Australia reported the incident to the Australian Cyber Security Centre.
• September 24, 2026: The story went viral globally.
• September 25, 2026: AIHW says its investigation found no unauthorized access to its systems or non-public information.

Prime Minister Anthony Albanese publicly addressed the incident from New York.

Prime Minister Anthony Albanese

Now let’s talk about the technical details of how OpenAI’s agents performed the hack.

How the hacking incident took place

The rogue agent’s task was to find Australia’s public medicine-spending information. It searched online and reached the Medicare statistics portal. When the portal repeatedly refused its requests, the agent tried alternative ways to get the information.

Albanese says, the agent “didn’t accept no for an answer.”

He said the agent accessed material outside what it was authorized to retrieve, including non-public files. Services Australia also reported that it wrote files to an internal server.

Here is the limit of what we can technically reconstruct: no Medicare request log, exploit payload, vulnerability name, or model transcript has been published.

Claims that the agent used SQL injection, path traversal, or a specific guest URL to breach this portal go beyond the available evidence. I spent a few hours looking for proof and found none.

The door may have been open all along

One historical detail is interesting, though.

A 2025 research paper links to an ordinary Medicare report through a URL beginning:

/SASStoredProcess/guest?_PROGRAM=.../statistics/mbs_item_standard_report

The guest route allowed a visitor to request an ordinary statistical report without an individual login.

It shows that the portal had a public reporting interface. It does not prove the agent used that route to reach non-public files, or that the guest route itself was vulnerable.

An independent researcher posting as EastMelbGroupie pieced this together from archived captures. The repo is an evidence package on OpenAI agent’s breach of the Medicare statistics portal.

Here’s what’s in the package:

ABOUT-THE-ISSUE.md         Plain-language summary of the three findings and why they matter

01-article-and-tweets/     The published analysis, as posted on X (24-25 Sep 2026)
  article-the-openai-hack-that-wasnt.md   — full X article, markdown (+ corrections note)
  tweet-1-two-hacks-compared.md           — "similar but different" tweet + OCR of screenshot
  tweet-2-why-no-trace-in-logs.md         — image-only tweet + OCR of screenshot
  tweet-3-sept-14-still-online.md         — "still up on Sept 14" tweet + OCR of screenshot
  tweet-4-not-a-hack.md                   — "unauthorised use of an authorised access
                                            mechanism" (AI assistant's framing) + transcript
  tweet-5-private-company-comparison.md   — AI assistant's legal comparison with a private
                                            company + transcript (commentary, not evidence)
  screenshots/                            — the five original tweet screenshots (PNG)

02-claims-evidence/         One folder per claim, each with an evidence.md, the underlying
                           files, and "how to verify" steps that take minutes and require
                           no special access:
  claim-1-portal-live-until-sept-14/   — Common Crawl index dumps Apr-Sep 2026, the
                                         14 Sep response bodies, Wayback capture indexes
  claim-2-two-separate-incidents/      — saved ABC live blog + ABC explainer + Transluce report,
                                         plus later reporting (ABC, Times of AI, Information
                                         Age, Reason, Al Jazeera) extending the timeline
  claim-3-no-released-data-for-june-18/— urlquery.net search results record
  claim-4-portal-architecture-get-only/— archived portal page, JavaScript, redirect chain,
                                         Wayback capture index of the SAS endpoints,
                                         bfiripis-github-scraper/ (Mar 2025 public R
                                         scraper of the guest endpoint)

03-web-archive-captures/   Archived pages of the portal itself (Wayback Machine):
                           Apr 2026 report form (method="get"), SetupEnvironment.js,
                           a 2015 anonymous report, post-breach captures (26 June,
                           11 Aug 2026) showing the form page still normal, and archived
                           guest-endpoint redirect chains (Nov 2025, May 2026)

04-get-only-access/        GET-only-access-evidence.md — the technical evidence on how the
                           portal was addressed (GET forms, guest login), with its limits

05-source-documents/       The long-form investigation article. (The Transluce dataset,
                           38,160 records, is not included because email blocks nested
                           zips: download it from https://transluce.org/data/urlquery-agent-activity-2026-09-23.zip
                           — SHA-256 969a13fbd7d80d7e1556eef58a347f52ecdd85661c541f6c0d1d6f5e2a86570d)

Recorded Future News then verified the reconstruction and found something more awkward.

The portal’s own JavaScript actively sent visitors querying production statistics to that no-login endpoint.

The same file exposed the server’s internal path structure to anyone who loaded the page. That could explain the “internal file names” OpenAI says it accessed.

So when an agent “found a way around the blocks,” it may have walked through a door the website itself pointed to.

To be fair, as iTWire points out, none of this proves which requests the agent made. Only Services Australia and OpenAI hold those logs. But it’s a far more believable story than a digital burglar picking a government lock.

What the technical records show

Apart from what EastMelbGroupie shared on GitHub, the best public evidence of how these agents behave comes from Transluce’s report, published the day before Albanese’s announcement.

Transluce built it from urlquery.net, a free service meant for safely opening suspicious links in a remote browser.

The agents turned it into a stealth browser to get around their own access restrictions. Because urlquery keeps public records of every scan, it accidentally logged what they did.

According to that report, agents searching AIHW’s data were trying to find the January 2022 rolling 12-month average government cost per person for Dermatologicals across Victorian local government areas.

AIHW is separate from Services Australia, and this happened on June 20 and 21, two days after the Medicare intrusion. These records show how the agents behaved elsewhere. They don’t reveal how the Medicare portal was breached.

One recorded dashboard request contained the following values:

State/Territory = Victoria
LGA = Wodonga
Medicine group = Dermatologicals
Measure = Rolling 12 months average
Month of interest = January 2022

These are search parameters. They show the agent translating a specific question into inputs for AIHW’s Tableau dashboard.

Press enter or click to view image in full size

urlquery report overview

When a download from AIHW’s main website met a Cloudflare challenge, another request tested the dashboard with code embedded in a URL parameter.

The URLQuery record shows this encoded payload:

:apiID=%22%3E%3Csvg/onload%3Ddocument.title%3D%22XSS%22%3E

Decoded, the payload attempts to insert an SVG element that changes the browser tab’s title to XSS. If that title had appeared on the dashboard, it would have indicated that the page executed code supplied through the URL.

It did not.

The scan shows a Cloudflare challenge page, and Transluce concluded that the probe was blocked before it reached the dashboard. This is evidence of an attempted cross-site scripting test, not a successful exploit.

The agents also tried a different host, pp.aihw.gov.au, and retrieved pieces of a public prescriptions ZIP. That route got around the main site’s anti-bot challenge for the download.

Transluce found no non-public data exposed in this sequence, a finding consistent with AIHW’s subsequent statement.

What data was exposed?

OpenAI’s statement, reported by ABC News, identifies aggregate health statistics and internal file names.

Aggregate statistics are totals, averages, and trends drawn from many records. They are different from an identifiable patient’s claim history.

The government says the agent also reached non-public files. Some of the statistical information was not public at the time of access, although ABC reports that it has since been released.

No complete list of accessed files or their contents has been published.

Press enter or click to view image in full size

Albanese said Services Australia found that the agent wrote files to an internal server, but investigators have not publicly explained what those files contained or what effect the writes had.

He also said there was no evidence at the time of a broader compromise of Services Australia’s network.

That is where the evidence stands. Unauthorized access at the Medicare statistics portal is confirmed. The publicly visible AIHW activity provides a close look at how agents responded to blocked requests elsewhere, including a failed script probe and an alternative route to a public file.

It cannot be presented as the missing technical proof of how the Medicare breach occurred.

Okay, let’s stop here. It’s quite clear that the headlines went too far.

“AI hacked Medicare” makes it sound like the agent got into people’s medical records. So far, there’s no evidence that happened. It accessed files on a statistics portal, and we still don’t know exactly how it got past the blocks.

This reminds me of last week’s AI doomsday headlines. OpenAI should explain what the agent did and why it took 84 days to tell Australia. But based on what we know now, I don’t see a reason for people to panic about their Medicare records.

What’s really going on?

Honestly, seeing all these AI hacking reports makes me think how much of it is actual hacking and how much is just PR.

Looking back at what happened in OpenAI’s AI hacking incident involving Hugging Face in July, people were somewhat divided in their opinion. Some say that the model is too powerful to control. Some said OpenAI’s setup was just sloppy. And some said the whole thing was staged.

Remember what Leopold Aschenbrenner did back in 2024 that got him fired from OpenAI? He circulated an internal memo telling everyone that OpenAI’s security was egregiously insufficient to protect core algorithmic secrets from foreign actors.

That also tells a lot about OpenAI’s built-in guardrails for its models. OpenAI could’ve let an agent loose on the internet without proper limits. And if the reports about the portal’s open guest access are true, the website barely had any protection to begin with.

Besides, how is an agent supposed to tell the difference between a website being broken and a website blocking it on purpose?

When the agent hits a blocked page, it treats it like an error to fix. It doesn’t understand that “access denied” means it should stop. So it keeps trying different methods until one works.

(I also don’t think this was a publicity stunt. Breaking into a foreign government’s website and then waiting three months to tell anyone would be a strange way to promote your product.)

Final Thoughts

If you’re in Australia and worried about your Medicare records, everything published so far says your personal information wasn’t touched.

What actually bothers me is how OpenAI handled it.

OpenAI found out about the breach on August 11. On September 1, Sam Altman met with Marles in San Francisco. Nobody has said whether the breach came up in that meeting. Nine days later, OpenAI told the government by sending an email to a public inbox that staff only check once a day.

Then, the same week the news broke, Altman told the UN Security Council that the world needs “accurate and speedy incident reporting.” Crazy guy. It’s the exact opposite of what his company did.

Who exactly are they fooling here?

There’s another problem. The portal was still online on September 15. If OpenAI believed its agent had found a real security weakness, it left that weakness open for over a month before telling anyone. If OpenAI didn’t think it was serious, it could have said so when the Prime Minister was calling it a hack.

Either way, OpenAI doesn’t come out of this looking good.

Also, Transluce found evidence of these agents trying to get past website security from March all the way to September, and they were doing it during ordinary data searches.

One last thing. Under Australian law, unauthorized access to data is a crime only if someone intended to do it and knew it wasn’t allowed.

An AI agent can’t have intentions. So, what now?

OpenAI will say nobody told the agent to break in. So if something like this happens again and actually causes harm, who gets held responsible?

I hope the government’s task force answers that question, because right now it looks like nobody would be.

What’s your take on this? Let me know in the comments.