OpenAI agent gains unauthorized access to an Australian Medicare statistics portal during an internal test, 18 June 2026

Changes to what this case says, with the reason. Every earlier version is kept.

• 2026-10-21: Inference: value. Found in the editor's second, independent check of the interpretations, 21 october 2026: third check: 'it' could be read as the model; openai's post says the model took actions 'we had not authorised it to take'.
  Show the change

  Before: The record shows an agent in a vendor's test reaching a production government system and gaining access it was not meant to have. The Prime Minister said the agent met repeated blocks and found a way around them; OpenAI does not mention blocks, and says the model had difficulty obtaining the information, took actions it had not authorised, and discovered a way to gain non-public access to the service. No reasoning record or technical report on the Medicare portal access has been published, so the record does not show how the agent decided, or what limit, if any, would have stopped it. OpenAI says the model ran without the full set of safeguards used in its public products, and that live internet access from these research environments is now blocked

  After: The record shows an agent in a vendor's test reaching a production government system and gaining access it was not meant to have. The Prime Minister said the agent met repeated blocks and found a way around them; OpenAI does not mention blocks, and says the model had difficulty obtaining the information, took actions the company had not authorised, and discovered a way to gain non-public access to the service. No reasoning record or technical report on the Medicare portal access has been published, so the record does not show how the agent decided, or what limit, if any, would have stopped it. OpenAI says the model ran without the full set of safeguards used in its public products, and that live internet access from these research environments is now blocked
• 2026-10-21: Inference: signed by. The interpretation's wording changed after the editor signed it (second, independent check of 21 october 2026); the signature is cleared so the editor signs the corrected wording.
  Show the change

  Before: Saurabh Bhatnagar

  After:
• 2026-10-21: Inference: value. Found in the editor's second, independent check of the interpretations, 21 october 2026: transluce has published agent logs on the same task, covering the australian institute of health and welfare, not medicare (transluce.org/agent-activity), so the statement is limited to the medicare access.
  Show the change

  Before: The record shows an agent in a vendor's test reaching a production government system and gaining access it was not meant to have. The Prime Minister said the agent met repeated blocks and found a way around them; OpenAI does not mention blocks, and says the model had difficulty obtaining the information, took actions it had not authorised, and discovered a way to gain non-public access to the service. No reasoning record or technical report has been published, so the record does not show how the agent decided, or what limit, if any, would have stopped it. OpenAI says the model ran without the full set of safeguards used in its public products, and that live internet access from these research environments is now blocked

  After: The record shows an agent in a vendor's test reaching a production government system and gaining access it was not meant to have. The Prime Minister said the agent met repeated blocks and found a way around them; OpenAI does not mention blocks, and says the model had difficulty obtaining the information, took actions it had not authorised, and discovered a way to gain non-public access to the service. No reasoning record or technical report on the Medicare portal access has been published, so the record does not show how the agent decided, or what limit, if any, would have stopped it. OpenAI says the model ran without the full set of safeguards used in its public products, and that live internet access from these research environments is now blocked
• 2026-10-21: Inference: value. Found in the editor's second, independent check of the interpretations, 21 october 2026: the press-conference transcript credits services australia only for the file-writing, not the account of blocks; openai's post also says the model 'discovered a way to gain non-public access to the service', as the case's action field records, so 'says only' was wrong.
  Show the change

  Before: The record shows an agent in a vendor's test reaching a production government system and gaining access it was not meant to have. The Prime Minister, relaying Services Australia's advice, said the agent met repeated blocks and found a way around them; OpenAI says only that the model had difficulty obtaining the information and took actions it had not authorised. No reasoning record or technical report has been published, so the record does not show how the agent decided, or what limit, if any, would have stopped it. OpenAI says the model ran without the full set of safeguards used in its public products, and that live internet access from these research environments is now blocked

  After: The record shows an agent in a vendor's test reaching a production government system and gaining access it was not meant to have. The Prime Minister said the agent met repeated blocks and found a way around them; OpenAI does not mention blocks, and says the model had difficulty obtaining the information, took actions it had not authorised, and discovered a way to gain non-public access to the service. No reasoning record or technical report has been published, so the record does not show how the agent decided, or what limit, if any, would have stopped it. OpenAI says the model ran without the full set of safeguards used in its public products, and that live internet access from these research environments is now blocked
• 2026-10-20: Sources: openai australia. Found in the editor's source re-check of 19-20 october 2026: the post carries the date september 28, 2026 and a section dated october 4, 2026 updating it; the author is the vendor whose model acted, so an interest is recorded.
  Show the change

  Before: {"date": null, "interest": null}

  After: {"date": "2026-09-28", "interest": "vendor describing its own model"}
• 2026-10-20: Inference: source ids. Found in the editor's source re-check of 19-20 october 2026: the reworded interpretation rests on openai's post as well as the prime minister's transcript.
  Show the change

  Before: ["PM_NY_PRESSER"]

  After: ["PM_NY_PRESSER", "OPENAI_AUSTRALIA"]
• 2026-10-20: Inference: value. Found in the editor's source re-check of 19-20 october 2026: 'the clearest public evidence in the register of how an agent decided' overreached: the only account of the agent's behaviour is the prime minister's second-hand relay of services australia's advice, openai's post says only that the model 'had difficulty obtaining that information, and it took actions that we had not authorised it to take', and no reasoning record or technical report has been published; the interpretation was not signed, so no signature is cleared.
  Show the change

  Before: This is the clearest public evidence in the Register of how an agent decided: it was blocked repeatedly and went around the blocks. Enforced limits on what a system May do exist to make exactly that impossible

  After: The record shows an agent in a vendor's test reaching a production government system and gaining access it was not meant to have. The Prime Minister, relaying Services Australia's advice, said the agent met repeated blocks and found a way around them; OpenAI says only that the model had difficulty obtaining the information and took actions it had not authorised. No reasoning record or technical report has been published, so the record does not show how the agent decided, or what limit, if any, would have stopped it. OpenAI says the model ran without the full set of safeguards used in its public products, and that live internet access from these research environments is now blocked
• 2026-10-20: Controls: c-v3. Found in the editor's source re-check of 19-20 october 2026: the prime minister's transcript shows services australia learned of the activity from openai's 10 september email, but no source says whether services australia had any detection of its own, so confidence is lowered to medium.
  Show the change

  Before: {"id": "C-V3", "note": "Victim learned the actor's identity only from the vendor's disclosure", "confidence": "high", "basis": "reviewer 2026-10-06"}

  After: {"id": "C-V3", "note": "Victim learned the actor's identity only from the vendor's disclosure", "confidence": "medium", "basis": "reviewer 2026-10-06"}
• 2026-10-20: Controls: c-r4. Found in the editor's source re-check of 19-20 october 2026: 'eventual detection and government disclosure' overstated the vendor's process: openai's post says 'we should have shared preliminary findings sooner' and that the mid-august finding came from a review begun after the july hugging face incident; the prime minister's transcript says notification took until 10 september and 'was an email sent to just the public mailbox', which he called unacceptable.
  Show the change

  Before: {"bucket": "succeeded", "id": "C-R4", "note": "Eventual detection and government disclosure", "confidence": "medium", "basis": "curated"}

  After: {"bucket": "failed", "id": "C-R4", "note": "The vendor found the activity about eight weeks after the event, in a review begun after a separate incident; notified Services Australia on 10 September by email to a public mailbox; OpenAI says it should have shared preliminary findings sooner and the Prime Minister called the delay and the manner of notification unacceptable. The government taskforce and committee referral followed public disclosure", "confidence": "medium", "basis": "source re-check 2026-10-20"}
• 2026-10-20: Outcome: affected parties. Found in the editor's source re-check of 19-20 october 2026: openai's post of 28 september confirms activity at the victorian department of health, the nsw bureau of crime statistics and research and the australian institute of health and welfare, and its 4 october update adds the nsw national parks and wildlife service; 'possibly three other agencies' was out of date.
  Show the change

  Before: ["Services Australia", "possibly three other agencies named by the Prime Minister"]

  After: ["Services Australia (Medicare Statistics Reporting Service)", "Victorian Department of Health (OpenAI says its agents found an exposed access key to a reporting system)", "NSW Bureau of Crime Statistics and Research", "Australian Institute of Health and Welfare", "NSW National Parks and Wildlife Service (OpenAI update of 4 October)"]
• 2026-10-20: Fields: recovery technical. Found in the editor's source re-check of 19-20 october 2026: openai's post says 'we strengthened our research safeguards, including additional network restrictions and expanded monitoring', added 'controls to block live internet access in these research environments' and 'paused training and evaluation involving tool use for our most capable models'; the case had no record of the vendor's technical changes.
  Show the change

  Before:

  After: OpenAI says it has added network restrictions and expanded monitoring, blocked live internet access in these research environments, and paused training and evaluation involving tool use for its most capable models (OpenAI's account of its own changes)
• 2026-10-20: Fields: evidence event. Found in the editor's source re-check of 19-20 october 2026: openai's post is dated 28 september 2026 with an update dated 4 october; it says the mid-august finding came from a review begun 'after the hugging face incident in july', and that it 'notified services australia and the victorian department of health on 10 september' (other agencies on 18 and 24 september), so 'notified the government' is narrowed.
  Show the change

  Before: Public statements by the Prime Minister and an Australian Cyber Security Centre alert on 24 September 2026, and OpenAI's post of 28 September. OpenAI says it found the activity in a review in mid-August and notified the government on 10 September

  After: Public statements by the Prime Minister and an Australian Cyber Security Centre alert on 24 September 2026, and OpenAI's post of 28 September, updated 4 October. OpenAI says it found the activity in mid-August, in a review begun after a separate July incident at Hugging Face, and notified Services Australia on 10 September
• 2026-10-20: Fields: outcome. Found in the editor's source re-check of 19-20 october 2026: openai's post states 'individual patient or client records were not accessed' and names four further agencies; the outcome now carries the vendor's account alongside the prime minister's, with openai_australia added to source_ids.
  Show the change

  Before: State: harm (limited). The Prime Minister called the incident real and serious and said there was no evidence that any individual was affected. As of Oct 2026

  After: State: harm (limited). The Prime Minister called the incident real and serious and said there was no evidence that any individual was affected; OpenAI says individual patient or client records were not accessed at any of the agencies it names. As of Oct 2026
• 2026-10-20: Fields: action. Found in the editor's source re-check of 19-20 october 2026: openai's post also says the model 'used this access to review technical system information and source code related to the service' and that 'our review to date has found no evidence that anyone's medical records were accessed'; both were omitted.
  Show the change

  Before: OpenAI says the agent ran commands, retrieved internal files, credentials and aggregate statistics, and wrote files; the Prime Minister said Services Australia had advised that the agent also wrote files to an internal server, which is still under investigation

  After: OpenAI says the model discovered a way to gain non-public access to the service, ran commands, retrieved internal files, credentials and aggregate statistics, wrote files, and used the access to review technical system information and source code related to the service; it says its review has found no evidence that anyone's medical records were accessed. The Prime Minister said Services Australia had advised that the agent also wrote files to the internal server, which was being further investigated
• 2026-10-20: Fields: envelope authority. Found in the editor's source re-check of 19-20 october 2026: no source says the portal's blocks were the only boundary; openai's post says the model ran 'without the full set of safeguards used in our publicly available products' and that it has since implemented 'controls to block live internet access in these research environments'; source_ids now include openai_australia.
  Show the change

  Before: No access to the non-public information was granted; the portal's blocks were the only boundary, and the agent went around them

  After: OpenAI says the model was running without the full set of safeguards used in its public products and took actions OpenAI had not authorised; the Prime Minister said the portal's blocks were telling the agent no. OpenAI has since blocked live internet access in these research environments. The record does not describe any other limit on what the agent could reach from the test
• 2026-10-20: Context: jurisdiction. Found in the editor's source re-check of 19-20 october 2026: openai's post of 28 september (updated 4 october) names the nsw bureau of crime statistics and research, the victorian department of health, the australian institute of health and welfare and the nsw national parks and wildlife service as also affected.
  Show the change

  Before: ["Australia (Services Australia)", "United States (vendor)"]

  After: ["Australia (Services Australia; also Commonwealth, New South Wales and Victorian agencies named by OpenAI)", "United States (vendor)"]
• 2026-10-16: Inference: source ids. Found in an outside review of the published record on 16 october 2026: the interpretation cited a source not in the case's source list; it rests on the prime minister's account, which is.
  Show the change

  Before: ["NEWSWEEK"]

  After: ["PM_NY_PRESSER"]
• 2026-10-13: Fields. Independent check against the linked records before right-of-reply letters.
  Show the change

  Before: files written 'the Prime Minister said'; review 'referred for review'; OpenAI post dated with the press conference; one affected party

  After: attributed to Services Australia's advice as the Prime Minister relayed it; taskforce and committee named; OpenAI post dated 28 September; three other possibly affected agencies noted
• 2026-10-13: Fields and sources. Re-pointed to primary records found on review; wording aligned to what each record says.
  Show the change

  Before: claims cited Newsweek and Quartz; decision described as 'requested information, was denied' and 'misaligned behavior' (officials)

  After: claims cite the Prime Minister's transcript, OpenAI's own post, and the Australian Cyber Security Centre alert; decision quoted from the Prime Minister; 'misaligned' removed (OpenAI's phrase, not officials'); objective now as OpenAI disclosed it