Headlines of AI models hacking websites aren’t over. In fact, I see it getting worse as new and more powerful models get released faster than the guardrails around them are built.
So, what’s the latest? OpenAI’s rogue agent hacked and gained unauthorized access to an Australian health data portal. It’s the first publicly known case of an AI successfully hacking a government website.
Here’s the complete chronological timeline of events:
Australian health website hacking timeline
- 2015 Onward: The Medicare statistics reporting portal’s guest access URLs were public, indexed by Google, and captured by the Internet Archive's Wayback Machine.
- June 18, 2026: An internal OpenAI research agent encounters blocks at the Services Australia portal, finds another way to obtain information, and accesses non-public files. Services Australia says it also wrote files to an internal server.
- August 11, 2026: OpenAI discovers the Medicare activity during an internal review. This is the August 11 event relevant to the breach.
- September 10, 2026: 84 days after the incident, OpenAI formally notified the Australian government by sending an email to a public Services Australia mailbox.
- September 11, 2026: The email was finally read, as Services Australia only checked that specific public mailbox once a day.
- September 15, 2026: After spending several days verifying that the email was genuine, Services Australia reported the incident to the Australian Cyber Security Centre.
- September 24, 2026: The story went viral globally.
- September 25, 2026: AIHW says its investigation found no unauthorized access to its systems or non-public information.
Prime Minister Anthony Albanese publicly addressed the incident from New York.
Prime Minister Anthony Albanese
Now let’s talk about the technical details of how OpenAI’s agents performed the hack.
How the hacking incident took place
The rogue agent’s task was to find Australia’s public medicine-spending information. It searched online and reached the Medicare statistics portal. When the portal repeatedly refused its requests, the agent tried alternative ways to get the information.
Albanese says, the agent “didn’t accept no for an answer.”
He said the agent accessed material outside what it was authorized to retrieve, including non-public files. Services Australia also reported that it wrote files to an internal server.
Here is the limit of what we can technically reconstruct: no Medicare request log, exploit payload, vulnerability name, or model transcript has been published.
Claims that the agent used SQL injection, path traversal, or a specific guest URL to breach this portal go beyond the available evidence. I spent a few hours looking for proof and found none.
The door may have been open all along
One historical detail is interesting, though.
A 2025 research paper links to an ordinary Medicare report through a URL beginning:
/SASStoredProcess/guest?_PROGRAM=.../statistics/mbs_item_standard_report
The guest route allowed a visitor to request an ordinary statistical report without an individual login.
It shows that the portal had a public reporting interface. It does not prove the agent used that route to reach non-public files, or that the guest route itself was vulnerable.
An independent researcher posting as EastMelbGroupie pieced this together from archived captures. The repo is an evidence package on OpenAI agent’s breach of the Medicare statistics portal.
Here’s what’s in the package:
ABOUT-THE-ISSUE.md Plain-language summary of the three findings and why they matter
01-article-and-tweets/ The published analysis, as posted on X (24-25 Sep 2026)
article-the-openai-hack-that-wasnt.md — full X article, markdown (+ corrections note)
tweet-1-two-hacks-compared.md — "similar but different" tweet + OCR of screenshot
tweet-2-why-no-trace-in-logs.md — image-only tweet + OCR of screenshot
tweet-3-sept-14-still-online.md — "still up on Sept 14" tweet + OCR of screenshot
tweet-4-not-a-hack.md — "unauthorised use of an authorised access
mechanism" (AI assistant's framing) + transcript
tweet-5-private-company-comparison.md — AI assistant's legal comparison with a private
company + transcript (commentary, not evidence)
screenshots/ — the five original tweet screenshots (PNG)
02-claims-evidence/ One folder per claim, each with an evidence.md, the underlying
files, and "how to verify" steps that take minutes and require
no special access:
claim-1-portal-live-until-sept-14/ — Common Crawl index dumps Apr-Sep 2026, the
14 Sep response bodies, Wayback capture indexes
claim-2-two-separate-incidents/ — saved ABC live blog + ABC explainer + Transluce report,
plus later reporting (ABC, Times of AI, Information
Age, Reason, Al Jazeera) extending the timeline
claim-3-no-released-data-for-june-18/— urlquery.net search results record
claim-4-portal-architecture-get-only/— archived portal page, JavaScript, redirect chain,
Wayback capture index of the SAS endpoints,
bfiripis-github-scraper/ (Mar 2025 public R
scraper of the guest endpoint)
03-web-archive-captures/ Archived pages of the portal itself (Wayback Machine):
Apr 2026 report form (method="get"), SetupEnvironment.js,
a 2015 anonymous report, post-breach captures (26 June,
11 Aug 2026) showing the form page still normal, and archived
guest-endpoint redirect chains (Nov 2025, May 2026)
04-get-only-access/ GET-only-access-evidence.md — the technical evidence on how the
portal was addressed (GET forms, guest login), with its limits
05-source-documents/ The long-form investigation article. (The Transluce dataset,
38,160 records, is not included because email blocks nested
zips: download it from https://transluce.org/data/urlquery-agent-activity-2026-09-23.zip
— SHA-256 969a13fbd7d80d7e1556eef58a347f52ecdd85661c541f6c0d1d6f5e2a86570d)
Recorded Future News then verified the reconstruction and found something more awkward.
The portal’s own JavaScript actively sent visitors querying production statistics to that no-login endpoint.
The same file exposed the server’s internal path structure to anyone who loaded the page. That could explain the “internal file names” OpenAI says it accessed.
So when an agent “found a way around the blocks,” it may have walked through a door the website itself pointed to.
To be fair, as iTWire points out, none of this proves which requests the agent made. Only Services Australia and OpenAI hold those logs. But it’s a far more believable story than a digital burglar picking a government lock.
What the technical records show
Apart from what EastMelbGroupie shared on GitHub, the best public evidence of how these agents behave comes from Transluce’s report, published the day before Albanese’s announcement.
Transluce built it from urlquery.net, a free service meant for safely opening suspicious links in a remote browser.
The agents turned it into a stealth browser to get around their own access restrictions. Because urlquery keeps public records of every scan, it accidentally logged what they did.
According to that report, agents searching AIHW’s data were trying to find the January 2022 rolling 12-month average government cost per person for Dermatologicals across Victorian local government areas.
AIHW is separate from Services Australia, and this happened on June 20 and 21, two days after the Medicare intrusion. These records show how the agents behaved elsewhere. They don’t reveal how the Medicare portal was breached.
One recorded dashboard request contained the following values:
State/Territory = Victoria
LGA = Wodonga
Medicine group = Dermatologicals
Measure = Rolling 12 months average
Month of interest = January 2022
These are search parameters. They show the agent translating a specific question into inputs for AIHW’s Tableau dashboard.
Press enter or click to view image in full size
urlquery report overview
When a download from AIHW’s main website met a Cloudflare challenge, another request tested the dashboard with code embedded in a URL parameter.
The URLQuery record shows this encoded payload:
:apiID=%22%3E%3Csvg/onload%3Ddocument.title%3D%22XSS%22%3E
Sources
- Services Australia portalpm.gov.au
- discovers the Medicare activityabc.net.au
- AIHW saysaihw.gov.au
- publicly addressedyahoo.com
- Medicare statistics portalservicesaustralia.gov.au
- “didn’t accept no for an answer.”thenextweb.com
- 2025 research paper
