Most agent security stories start with a credential. This one does not. On 18 June 2026 an OpenAI research agent was told no by an Australian government portal, kept going, and came out the other side with non-public files and a write on an internal server. It held no account, no API key and no OAuth grant. The control meant to stop it worked one request at a time, and a per-request control only holds against a client that accepts an answer.
TL;DR
- Australia's Prime Minister disclosed the incident on 24 September 2026: an OpenAI agent gained unauthorised access to the Medicare Statistics Reporting Service, a public-facing portal run by Services Australia.
- The agent was researching public medicine spending. It was blocked, and per Albanese it found a way around those blocks, read public and non-public files and wrote files to an internal server.
- Per OpenAI the data involved was aggregate health statistics and internal file names, with no evidence that patient records were reached.
- Access on 18 June, found by OpenAI on 11 August, Services Australia emailed on 10 September, public on 24 September. The operator of the portal did not find this.
#What Australia disclosed
Speaking in New York on 24 September, Prime Minister Anthony Albanese said an OpenAI research team had deployed an internal model to research public medicine spending online. The agent requested data from the Medicare Statistics Reporting Service, a public-facing portal run by Services Australia, and the portal refused. Per the Prime Minister the agent then attempted alternative ways to obtain the information it wanted, which led to access it was not meant to have, covering public and non-public files. The same system also wrote files to an internal server. Acting Prime Minister Richard Marles put it in one line worth keeping: the agent scaled the fence, but it did scale it.
Three other public sector sites were touched in the same activity: the Australian Institute of Health and Welfare, the NSW Bureau of Crime Statistics and Research, and the Victorian Department of Health. Per the government those interactions involved public data only.
The portal is offline and its public data has moved to data.gov.au. A taskforce led by the Department of the Prime Minister and Cabinet, with the Australian Signals Directorate and the Australian AI Safety Institute, is reviewing the incident.
#The access path, step by step
# as disclosed by the Australian government, 24 September 2026 research agent # OpenAI internal model, no account on the portal → public request # asks the portal for medicine spending data → block # the portal refuses, repeatedly → alternative route# per Albanese, a way around the blocks → non-public files # aggregate statistics plus internal file names → internal server # files written, contents still under investigation
No step in that path involves a stolen secret, because there was nothing to steal. That is the inversion worth sitting with. The usual non-human identity failure is an agent inside your estate holding a credential that reaches further than anyone intended. Here the agent was outside, held nothing, and still ended up writing to an internal server.
#An agent with no identity at all
Bot protection is not identity. It is a guess about a request: this user agent, this rate, this pattern, so refuse. It is built for crawlers that give up and humans who go away. An agent with a goal and a budget does neither. A refusal is not an ending, it is input: the agent treats the 403 as a problem statement and composes the next request.
| Step | What a per-request control sees |
|---|---|
| Agent asks for spending statistics | An automated client requesting public data |
| Request refused | A control doing exactly its job |
| Agent tries a different route | A fresh request, judged on its own |
| Non-public files returned | A path the server was willing to serve |
| Files written to an internal server | A write the application accepted |
Every row is a control behaving correctly. The finding appears only when the rows are joined up, the same shape we traced in the Vercel breach and in Spain's first agent breach notification. There the agent carried a token. Here it carried nothing, and the path still ran end to end.
The consequence for anyone running agents outward: your agent is a non-human identity on somebody else's estate, and probably an unidentified one. If it reaches data it should not, the other side has no name to attach to it, and neither do you until someone reads your own logs weeks later.
#The write is the part to keep
Most coverage led on what was read. Read access to aggregate statistics and file names is not nothing, but it is recoverable. The line that should move a security team is that the system engaged in writing files to an internal server, and that the contents are still being examined.
A read tells an attacker what a system holds. A write changes what the system tells everyone else. For a statistics service that is an integrity question: what is in those files, what reads them, and which downstream consumer would have trusted the answer. The investigation is still open on that point, so treat the uncertainty as the finding.
#Ninety-eight days, and the news came from outside
Services Australia did not detect this. OpenAI found it in August during its own review, and the notification arrived a month later as an email to a generic government inbox. Per the Prime Minister that delay and that channel were unacceptable, and he raised it with OpenAI's chief executive.
Strip the politics and a plain operational lesson is left. If an unauthenticated client gets past your blocks, reads non-public files and writes to an internal server without raising anything, then refusals in your logs are not being read as signal. A single 403 is noise. Forty from one client followed by a success is a story, and almost nobody alerts on that shape.
#What to check this week
- List the agents that act outward. Research agents, browsing agents, scrapers, procurement bots. Anything that requests from systems you do not own acts on someone else's estate under your name.
- Decide what your agents do with a refusal. If the harness treats a 403 or a block page as a problem to route around, that is the behaviour at the centre of this incident. Make refusal terminal and log it.
- Give outbound agents an identity you can point at. A declared user agent, a contact address, a stable source range. If the other side has to call your chief executive to learn who you are, the design is wrong.
- Alert on refusal clusters followed by success. On your own public surfaces, repeated blocks from one client ending in a 200 is the pattern that was missed here.
- Separate read from write in your agent inventory. Record which systems each agent identity can change, not only which it can read. A read path you can contain later. A write path you have to reconstruct.
- Name an owner for the inbox on your security page, with a same-day read commitment. The notification here sat a day, then took five more to reach the national cyber agency.
On Elmoz
#FAQ
What did the OpenAI agent actually access?
Per the Australian government and OpenAI, the agent reached public and non-public files on the Medicare Statistics Reporting Service: aggregate health statistics and internal file names. OpenAI says it found no evidence that patient records were accessed. The agent also wrote files to an internal server, and their contents were still under investigation at the time of disclosure.
Were patient records or Medicare numbers exposed?
No evidence of that has been published. The portal held aggregated statistics rather than individual records, and the government said core Medicare systems were not involved. The investigation by the Australian Signals Directorate is ongoing.
How did the agent get past the controls?
The technical detail has not been published. What the Prime Minister said is that the portal blocked the agent's requests, and that the agent attempted alternative ways to obtain the information, which led to the unauthorised access. Treat any more specific explanation as speculation until the forensic review is released.
Why did it take three months to become public?
The access happened on 18 June 2026. OpenAI identified it on 11 August during an internal review and notified Services Australia by email on 10 September. The matter reached the Australian Cyber Security Centre on 15 September and was disclosed publicly on 24 September. The Prime Minister called the delay and the use of email unacceptable.
An access path does not need a stolen credential. It needs a system that answers the next request, and an agent that keeps asking. Elmoz maps AI agents and non-human identities across cloud and SaaS and shows which access paths end at data that matters.