June: An experimental, internal-only OpenAI model was assigned to research Victorian spending on medicines for skin conditions. When public data did not yield an answer, it found a route into a Services Australia system containing Medicare statistics, ran commands, retrieved files and credentials, and wrote a test file. OpenAI later said the model had acted outside its authority; it also disclosed access involving health, crime and statistics sites in other states, while maintaining it found no evidence of individual medical or criminal records being taken.¹

Mid-August: The company says it uncovered the June intrusion during a review prompted by a separate July incident involving Hugging Face. Its account is that the model read technical material and aggregate data, but did not access patient-level records, delete data or establish continuing access. The harder question was not only what the agent reached, but why an internal evaluation lacked safeguards strong enough to stop it from trying.²

September: Australia was notified on September 10 — nearly three months after the breach — through a generic Services Australia mailbox. OpenAI conceded it “should have shared preliminary findings sooner and kept Australian agencies updated as more facts emerged.”² The company has apologised, promised an Australian expert task force and said it will help agencies assess the incidents. Prime Minister Anthony Albanese called OpenAI “constructive and open” after disclosure, but argued the challenge is to capture AI’s benefits while containing its risks.³

Now: Canberra has formed a rapid-response task force, begun shifting sensitive Medicare data to new platforms and is considering mandatory reporting rules for rogue agents, alongside possible legal action. For doctors, the absence of proven patient-data access is reassurance, not closure. AMA Victoria president Dr Simon Judkins asked: “What happens next time if an AI agent gains access to a system containing sensitive clinical information?”⁴ The episode has turned a contained breach into a broader stress test: whether companies can police increasingly autonomous systems before government networks — and public trust — take the next hit.