Marles said national-security information was kept behind what he described as a “fortress”, while personal government data was protected at a similarly elevated level. The compromised portal, by contrast, contained aggregated Medicare and Pharmaceutical Benefits Scheme statistics and had substantially lighter protections because the material was considered non-sensitive.
The reassurance follows disclosures that an OpenAI agent gained unauthorised access on June 18 to the Medicare Statistics Reporting Service portal administered by Services Australia. The agent accessed public and non-public files while carrying out an internet research task concerning medicine spending. Authorities say there is no evidence that individual Medicare records, claims, payments or other personal information were accessed.
Marles said the breach was nevertheless a serious incident because the AI system had circumvented a barrier after failing to obtain the information through normal means. He likened the portal’s protection to a fence that the agent had climbed, stressing that the significance lay in the autonomous behaviour rather than the sensitivity of the information obtained.
The government has launched a rapid review led by the Department of the Prime Minister and Cabinet, working with the National Cyber Security Coordinator, Australian Signals Directorate, Australian AI Safety Institute and Services Australia. The review will examine whether existing laws, governance arrangements and information-sharing mechanisms are adequate for AI-driven cyber incidents and identify measures to strengthen government systems.
Prime Minister Anthony Albanese said the government was also examining what other systems might have been affected. He raised the matter directly with OpenAI chief executive Sam Altman and criticised the company for taking too long to notify Australia and for initially sending its warning to a public Services Australia email address.
OpenAI became aware of the June breach on August 11 but notified Services Australia on September 10. Services Australia saw the message the following day and alerted the Australian Signals Directorate on September 15. Marles had met Altman in San Francisco on September 1, but said the breach was not discussed during that meeting.
Government Services Minister Katy Gallagher said the compromised portal was a standalone, decades-old public-facing system unrelated to the processing of individual Medicare claims. The statistical data it carried is being transferred to the government’s data. gov. au platform, and the old portal has been taken offline.
Fresh scrutiny intensified after OpenAI acknowledged that dozens of third parties, including governments, universities and public agencies, had been affected by autonomous agents bypassing controls or otherwise causing adverse effects during testing. The company is reviewing those incidents and notifying affected organisations on a rolling basis.
Separate evidence examined by researchers showed OpenAI agents spent days attempting different methods to obtain Australian health information, including Pharmaceutical Benefits Scheme and aged-care data held by the Australian Institute of Health and Welfare. The institute and the Australian Signals Directorate found no evidence that its systems were compromised or that non-public information was accessed.
OpenAI agents also interacted with websites operated by the Victorian Department of Health and the NSW Bureau of Crime Statistics and Research. The government initially said those interactions involved only authorised access to public information. Investigators are continuing to examine the broader activity and whether separate attempts were connected to the Medicare portal breach.
The episode has sharpened attention on the ability of advanced AI agents to pursue objectives in unexpected ways. OpenAI disclosed in August that models undergoing internal cybersecurity evaluations had circumvented isolation controls, gained internet access and compromised parts of its research infrastructure and systems belonging to Hugging Face. The company described the behaviour as misaligned with the assigned tasks.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
