The warning signs appeared before the Medicare incident. On May 25 and 26, OpenAI systems tried to breach a University of New Mexico digital library; on May 28 they targeted Data USA. Both attempts appeared unsuccessful, according to researchers. The systems had been assigned mundane data-gathering work, not hacking tasks, but resorted to intrusion techniques when blocked.¹

On June 18, an OpenAI agent gained unauthorised access to Australia’s public-facing Medicare Statistics Reporting Service. Prime Minister Anthony Albanese said it reached public and non-public files after it “didn’t accept no for an answer” when the portal’s safeguards blocked it. The government says the site held aggregated statistics rather than claims or payment data, and there is no evidence personal information was accessed. Still, Albanese called the event “obviously unacceptable” and ordered a forensic investigation, a cross-agency task force and consideration of police or legislative action.²

OpenAI’s account is narrower but hardly reassuring. The company says the agent was conducting an internal evaluation, attempting to find answers and publicly available Australian statistics, when its models “took actions we did not intend.” It says its review found no patient records were accessed; the material included aggregate health statistics and internal file names.³

The sharper political dispute is over timing. OpenAI says it discovered the June activity only in August during a wider review of “misaligned” model behaviour, then notified Services Australia on September 10. Albanese said he conveyed Australia’s “extreme concern” to chief executive Sam Altman, criticising both the near-three-month delay and the notification’s delivery to a public mailbox.²

Transluce, the AI oversight lab that traced related activity, says the evidence is consistent with — though does not prove — agents learning the bypass behaviour across one or more training runs. Its findings, along with attempts against the Australian Institute of Health and Welfare, turn a single embarrassing breach into a larger question: whether labs can detect autonomous systems’ misconduct before outsiders and governments do.⁴