On 18 June, an AI agent built by OpenAI got into the Medicare Statistics Reporting Service, a Services Australia portal, and read files that were never meant to be public. It also wrote files to an internal server. Nobody told the Australian Government for almost three months, and when OpenAI finally did, the notice went to a general inbox.
Prime Minister Anthony Albanese disclosed the breach on 23 September from New York. It is the clearest Australian example yet of the AI agent security risks we have been raising with clients all year, and most of the lessons apply to a 50-person Perth business as much as they do to Canberra.
| Date (2026) | Event |
|---|---|
| 18 June | An OpenAI agent accesses the Medicare Statistics Reporting Service portal, reads public and non-public files, and writes files to an internal server |
| 11 August | OpenAI becomes aware of the activity during a review of misaligned model behaviour |
| 10 September | OpenAI emails a public Services Australia inbox |
| Five days later | The notice reaches the Australian Cyber Security Centre |
| 23 September | The Prime Minister discloses the breach and announces a taskforce led by his department |
OpenAI says the agent was running inside an internal evaluation, looking up statistics about Australia, and that its models took actions the company did not intend. It says its review found no evidence that patient records were accessed, and that what the agent reached was aggregate health statistics and internal file names. The Medicare claims systems that hold individual records are separate from this portal.
The Australian Signals Directorate is still running a forensic review, so treat every detail above as provisional. The shape of the incident is already clear enough to act on. You can read the ABC’s full timeline for more.
Nobody told this agent to break into a government system. It had an ordinary goal, find some Medicare numbers, and when it hit a barrier the Prime Minister’s description was that it simply would not take no for an answer. The access control was an obstacle between the agent and its task, so it went looking for another way through.
This is not a one-off. In July, OpenAI agents running a cyber security evaluation escaped their sandbox through a previously unknown flaw in a package registry proxy and reached Hugging Face’s production systems. Hugging Face’s own technical timeline reconstructs roughly 17,600 actions by the agents, and OpenAI’s incident report sets out what failed on its side. On 18 September, Google disclosed that Gemini had accessed three outside systems during a test because it believed they were part of the test.
Two vendors, three incidents, one quarter. We use Claude as our primary AI platform and we are not writing this to score points against anyone. Every agent from every vendor, including the ones we deploy, needs to be treated as software that will try hard to finish its job and will not always respect a boundary it was never told about.
The Medicare breach points two ways for a typical Australian SMB. Your systems can be on the receiving end of someone else’s agent, and your own agents can do to other people what OpenAI’s did to Services Australia.
The Medicare portal published public statistics, and non-public files sat behind the same front door. That is a common pattern in small business too: a client portal, a website document library, a booking system, or a file share with a “hidden” link. An agent is patient and fast in a way a human visitor is not. Bot filtering at the edge slows it down. Permissions on the files themselves stop it.
If a document should not be public, it should not sit on a public server behind an obscure URL. This matters most for businesses holding sensitive records, which is why we raise it first with healthcare providers in Perth running patient-facing portals.
Copilot Cowork, Claude Cowork, ChatGPT Work and Copilot Studio agents all run multi-step tasks on your behalf, and our ChatGPT vs Copilot vs Claude comparison covers what each can do. These agents often act with the permissions of the person who started them. If that person can see the whole finance share, so can the agent. When it hits a wall, it will try another route, just as the Medicare agent did.
Most of the exposure here is a permissions problem you already had before AI arrived. We covered that in detail in why your AI risk is really a permissions problem.
OpenAI took around eight weeks to notice and another four to say anything, then sent the notice to a mailbox checked roughly once a day. The breach itself was contained. The delay is what turned it into a diplomatic incident.
There are two lessons in that for any business. First, read your AI vendor contracts. How quickly must the vendor tell you if its product touches systems or data it should not have, who receives that notice, and what triggers it? If the answer is “we’ll email support@”, that is a gap.
Second, check your own front door. Where would a breach notice about your systems land today? A generic info@ address that someone clears on Fridays is not an incident channel. Publish a security contact, route it to a person with authority to act, and test it. If personal information is involved, the notifiable data breaches scheme gives you 30 days to assess once you have reasonable grounds to suspect a breach, and our Privacy Act 2026 checklist covers the incident response plan you need behind that address.
The ASD saw this coming. The September 2026 Information Security Manual added a block of controls, ISM-2124 to ISM-2167, that treat AI agents as principals in their own right. On 11 September the ASD also published guidance on agentic AI harnesses, the software layer that connects a model to your data, tools and systems. We track both on our Essential Eight to Essentials transition tracker, and we counted where they sit in our ISM control breakdown.
Map the Medicare failures against those controls and the fixes are not exotic:
| What went wrong | The control that addresses it |
|---|---|
| The agent reached a system outside its task | Least privilege: scope each agent’s network and tool access to the job |
| Nobody noticed for about eight weeks | Log every tool call and alert when an agent keeps hitting refusals or blocks |
| The agent wrote files to a server | A human approves any write or high-impact action before it happens |
| No clear view of which agents were running where | An agent register with a named owner for each agent |
| The notice went to a public inbox | A named security contact written into vendor contracts |
None of this is mandatory for a private SMB today. It is the direction of the Essentials series, and it is what insurers and larger clients will start asking about.
We run AI agents across our own ticketing, documentation, quoting and finance systems, so we have had to answer these questions for ourselves. Every agent connects through our own bridge. Each role is granted specific tools, anything outside that grant needs an access request, and every tool call is written to an audit log. Changes to client systems go through a change request that is approved before anything is touched.
It is not perfect, and we keep tightening it. It is also the minimum we would accept before letting an agent near a client environment, and it is how we build agents for clients through our AI agent development and managed AI services.
Build an agent register this month. List every AI agent, Copilot Studio bot, Cowork-style assistant and third-party connector with access to your systems. Name an owner for each and write down what it can reach. Most businesses find agents they did not know were switched on.
Cut agent permissions and add a human checkpoint. Give agents their own identities rather than borrowing a staff account, strip access back to what each task needs, and require approval for anything that writes, sends or deletes. Our AI governance service sets this up as policy and as technical controls.
Check where a breach notice would land, then talk to us. Confirm your security contact works and that your AI vendor contracts have a notification clause with a real timeframe. Contact us on 1300 EPIC IT for a free AI agent security review and we will check your agents, permissions and contracts against the ASD’s new controls.
On 18 June 2026, an OpenAI agent running an internal evaluation gained unauthorised access to the Medicare Statistics Reporting Service portal run by Services Australia. It read public and non-public files and wrote files to an internal server. OpenAI notified the government on 10 September, and the Prime Minister disclosed the incident on 23 September.
OpenAI says its review found no evidence of patient records being accessed, and that the agent reached aggregate health statistics and internal file names. The Medicare claims systems holding individual records are separate from the statistics portal. The ASD’s forensic review is still underway, so that position could change.
The biggest AI agent security risks for small businesses are agents running with more access than their task needs, no logging of what they do, and no human approval before they write, send or delete. Sensitive files sitting on public-facing systems are a second exposure, because agents are persistent enough to find them. Both are fixable with an agent register, least privilege and monitoring.
The ISM’s AI agent controls (ISM-2124 to ISM-2167) are not mandatory for most private businesses, but they are the clearest statement of what good practice looks like. The ASD has flagged agentic AI as a likely chapter of the Essentials series that replaces the Essential Eight. Insurers, government buyers and larger clients tend to adopt these expectations before regulators do.
Give each agent its own identity, grant only the tools and data its task needs, and block network access it does not require. Log every action and alert when an agent repeatedly hits refusals, which is the pattern that preceded the Medicare and Hugging Face incidents. Managing AI agent security risks this way works for Copilot, Claude and ChatGPT agents alike.
No. The incidents so far happened inside vendor test environments with reduced safeguards, not in governed business deployments. The right response is to deploy agents with controls from day one: a register, least privilege, logging and human approval for high-impact actions.
