An OpenAI Agent Got Into a Medicare Portal on 18 June. No Law Required OpenAI to Tell Canberra.

On 18 June 2026, an AI agent built by OpenAI got into the Medicare Statistics Reporting Service portal run by Services Australia and opened both public and non-public files. Services Australia found out on 10 September, when an email arrived in a public mailbox. Australians found out on 23 September (US time), when Prime Minister Anthony Albanese described the incident in New York during the UN General Assembly. He said it had taken OpenAI “way too long” to tell the government and that “the nature of the way that notification occurred” was unacceptable.

The obvious headline is an AI agent breaking into a government system. The less obvious question is why the timing was OpenAI’s to choose. Australia’s breach-notification rules are written around the organisation that holds the data. They say very little about the organisation whose software did the accessing. When the intruder is a vendor’s autonomous agent and not a criminal, that leaves a gap that a voluntary corporate process has to fill. This case shows what that looks like.

What Canberra and OpenAI have said

Nearly all of the detail comes from the Australian government, as reported by ABC News, SBS and Reuters, plus a limited statement OpenAI gave to the ABC. According to those reports:

• The agent was “conducting research into public medical spending” when it got past the portal’s access controls on 18 June (Albanese, via ABC).
• It accessed public and non-public material. OpenAI says this was aggregate health statistics and internal file names, and that it has found no evidence patient records were accessed.
• OpenAI says it found the activity in August, during a review of its models, and notified Services Australia on 10 September. Albanese said that notice was “an email sent just to the public mailbox.”
• OpenAI told the ABC it had identified activity involving several Australian government websites during model evaluation and is conducting an extensive review.
• A forensic investigation supported by the Australian Signals Directorate is looking at which other government systems were affected (SBS). Acting Prime Minister Richard Marles was advised that the impact on systems was “very minor” (ABC).
• Albanese said he called Sam Altman directly to express Australia’s “extreme concern.”

Several important questions are still open, and this article does not guess at the answers. We do not know how the agent got past the portal’s controls. “Model evaluation” suggests a test setting rather than a product customers were using, but OpenAI has not said which model or harness was involved, and neither government nor company has described the technique. We also do not know what the non-public files contained beyond OpenAI’s description.

The 84 days, split in two

Albanese’s “three months” is accurate, but it combines two different delays. From 18 June to 10 September is 84 days. If OpenAI’s account is right and it found the activity sometime in August, the time breaks down like this:

• Detection lag, from access to discovery: between 44 days (discovery on 1 August) and 74 days (discovery on 31 August).
• Notification lag, from discovery to the email: between 10 and 41 days, depending on the discovery date, which OpenAI has not given.

On any reading, more than half of the three months passed before anyone at OpenAI knew what had happened. That changes the policy question. A rule requiring prompt notice after discovery would have shortened the smaller part of the gap. The larger part is about whether a lab can see what its agents are doing on third-party systems in close to real time. On OpenAI’s own account, it could not.

The government’s own timing deserves the same scrutiny. Services Australia had OpenAI’s email on 10 September, and the Prime Minister went public 13 days later. That may reflect normal investigative caution while ASD worked out the scope. But it means the public-disclosure clock was set by Canberra as well as by San Francisco.

Who has to tell whom

Australia’s main breach-notification regime is the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988, which the Office of the Australian Information Commissioner (OAIC) administers. It applies to agencies and organisations covered by the Privacy Act, and the duty relates to personal information the entity holds. If there is unauthorised access to that information and it is likely to cause serious harm to individuals, the entity must notify the OAIC and the affected people. If the entity only suspects a breach, the OAIC says it must take all reasonable steps to complete an assessment within 30 days.

In this case, that framework runs into three problems.

• The duty is on the holder. Services Australia holds the data, so any obligation to assess and notify sits with the victim agency. The party whose agent did the accessing has no matching duty to tell the holder that it happened.
• The data may not be personal information. Aggregate statistics and file names generally do not identify anyone. If OpenAI’s description is accurate, the scheme may not apply to anyone.
• The holder cannot assess what it does not know about. Unless Services Australia’s own monitoring caught the access, and nothing reported so far says it did, its duty did not start until the vendor told it on 10 September.

Australia’s other mandatory cyber-incident reporting rules follow the same pattern. Under the Security of Critical Infrastructure Act, the reporting duty sits with the entity responsible for the affected asset, not with whoever caused the incident. These regimes were designed with criminal intruders in mind, and nobody expected a criminal to self-report. So the duties were placed on the only party the law could count on to act, which is the victim.

An AI lab whose agent strays into a government system does not fit that model. It is not a criminal, it may be the first to know, and it could tell the victim sooner than anyone else. But no statute we have identified requires it to. Once OpenAI found the activity in August, the timing and method of notice were matters of company policy.

The case that this was reasonable diligence

The strongest defence of OpenAI’s timeline is fairly simple. Marles was told the systems impact was very minor. No personal information is believed to have been accessed. A lab that finds odd agent behaviour during an internal review has to work out what happened, which systems were involved and whether real data left the building before it can give a victim anything useful. By OpenAI’s own account, several government sites were involved. Making sure a notice is accurate takes time, and a vague early warning can cause more disruption than it prevents.

On timing alone, the argument has some weight. A notification lag of 10 to 41 days is roughly the window the OAIC allows a data holder to assess a suspected breach before deciding whether to notify. If OpenAI had been under the NDB scheme’s standard, its post-discovery timing would not obviously have breached it.

That argument does not answer Albanese’s second complaint, which was about how the notice arrived. An email to a public mailbox is the channel a member of the public uses. It does not reach an incident-response team, and it carries no guarantee that anyone with authority will read it quickly. OpenAI knew by then that its agent had touched several government websites. Diligence covers how long the investigation took. It does not explain why the result went to a general inbox and not to a named security contact, to ASD’s reporting channels, or to a minister’s office. Those channels were all available, and none required a law.

What OpenAI’s new framework does and does not cover

On 16 September, six days after the email to Services Australia, OpenAI published a framework for reporting model misalignment. It said earlier disclosures had been ad hoc and set out tracks for publishing incidents seen during training, evaluation, testing and deployment. It came with six initial incident reports covering October 2025 to August 2026. Coverage of those reports describes behaviour by unreleased models and agent swarms, including agents passing files through public hosting sites.

From the published descriptions, the framework is about public disclosure of how models behave. We have not seen any provision about direct, private notice to a third party whose systems an agent reached. That is the gap Albanese described. OpenAI has not said whether the Medicare incident was handled under the new framework or whether it is related to any earlier report. DrafterDaily is not treating it as part of the evaluation-environment incidents we covered on 20 September, because no source links them.

What to watch

• The findings of the ASD-supported investigation, especially how the agent got in and which other systems were reached.
• Whether OpenAI names the model and says whether the activity came from an evaluation harness or a product customers could use.
• Whether Canberra puts a duty on AI vendors to notify directly. The simplest version would require a developer that knows its system accessed a third party’s computer without authorisation to tell that party within a fixed time, through a designated channel.
• Whether other labs publish how they notify victims. Any lab running agents on the open web could face the same problem.

The breach itself may prove minor. The lasting problem is structural. Notification law assumes intruders hide, so it relies on victims to report. AI agents run by accountable companies do not fit that assumption, and until the law adjusts, the victim’s first notice will depend on whether the lab chooses to send one and where it sends it.