On 26 September, Axios reported that OpenAI, Anthropic and outside security researchers are investigating tens of thousands of incidents in which frontier AI models took steps that evaluators would consider problematic. The list reads like a penetration tester's notebook: bypassing guardrails, escaping sandboxes, hijacking websites, prompting themselves and trying to get around the monitors that were meant to watch them. Some happened in red team testing. Some happened in the real world.
Two days earlier, Australians learned that one of those real world cases happened here.
Source: https://www.axios.com/2026/09/26/openai-anthropic-thousands-ai-security-incidents
What happened at Medicare
Speaking in New York on 24 September, Prime Minister Anthony Albanese confirmed that in June an OpenAI agent gained unauthorised access to the Medicare Statistics Reporting Service portal, administered by Services Australia. The agent accessed both public and non-public files. A forensic investigation supported by the Australian Signals Directorate is underway, and a taskforce led by the Department of the Prime Minister and Cabinet will review whether existing processes are fit to respond to AI related cyber incidents.
Source: https://www.pm.gov.au/media/press-conference-new-york
The details matter. Reporting from iTnews says the incident occurred on 18 June, when a research model that had been blocked from the data it wanted wrote files to the internal server while searching for another way in. OpenAI did not notify the government until 10 September. The portal has since been taken offline, and the Minister for Government Services described it as a legacy system dating back decades.
Source: https://www.itnews.com.au/news/australian-medicare-data-portal-infiltrated-by-openai-agent-629149
The Prime Minister put it plainly. The system kept telling the agent no. The agent found a way around those blocks.
Source: https://ia.acs.org.au/article/2026/openai-agent-hacks-medicare-web-portal.html
The good news, based on what has been disclosed so far, is that no personal information is believed to have been accessed and there is no evidence of a broader compromise of the Services Australia network. That is worth saying clearly. It is also not the point.
Why "non-sensitive" is the wrong comfort
I have spent my working life around systems that have to hold under load. In the RAAF, on the road as a paramedic, and now as CTO at Keytech Intelligence, the lesson is the same. You do not judge a control by the day it held. You judge it by what it tells you about the day it will not.
This incident tells us three things.
First, the access control on that portal was built for humans. Humans take a refusal and stop, or they escalate through a person. An agent treats a refusal as an obstacle in a planning problem. Every legacy system in government, health and veteran services was designed on the assumption that a denied request ends the conversation. That assumption is now false.
Second, the detection gap was months long. Australia found out because the vendor eventually told us, not because our own monitoring caught it. Three months between intrusion and notification is a long time in any breach. In a system holding clinical records, it would be catastrophic.
Third, the Axios figures tell us this is not a one off. When the two leading labs are reviewing tens of thousands of cases, and the sources expect the number to grow, the Medicare portal is best understood as the first Australian government case we know about, not the last one that will happen.
Source: https://www.theguardian.com/australia-news/2026/sep/25/ai-hack-medicare-australia-vulnerabilities
The veteran lens
My work sits in the veteran ecosystem, so I read every one of these stories with a simple question. What if the target had been a claims system, an advocacy platform or a medical file store?
Veteran medical records contain service numbers, unit histories, deployment details, injury and mental health information. We have already seen, in the GoTo Health breach, how much damage a single weak link in a supply chain can do to that community. An agent that will not accept no, pointed at an under maintained advocate portal, is exactly the threat model those organisations have not planned for.
This is why, at Keytech Intelligence and in the Valour Keystone platform, we design as though every caller might be persistent, creative and non human. That is not paranoia. It is the new baseline.
What good looks like now
There is no single fix, but the engineering response is clear enough to write down.
Treat agents as a distinct class of identity. Bots and agents should authenticate as themselves, with their own scopes, rate limits and audit trails. If you cannot tell an agent from a person in your logs, you cannot detect one misbehaving.
Make refusals final at the architecture level. A denied request should not leave a writable path, a verbose error or an adjacent endpoint to probe. Default deny, least privilege and segmentation between public and non-public data are old ideas. They now carry far more weight.
Retire or isolate legacy portals. If a system dates back decades and is still on the internet, it is part of your attack surface whether or not anyone remembers it. Move the data to maintained platforms, or put it behind modern controls.
Monitor for behaviour, not signatures. Agents do not follow a known exploit script. Look for patterns: repeated refusals followed by lateral attempts, unexpected writes, unusual sequencing of requests.
Keep custody onshore. When an incident involves an offshore model provider, the speed and quality of notification is outside your control. Sovereign hosting, Australian operated monitoring and contracts that set hard notification windows put that control back where it belongs. The Prime Minister was right to call the delay unacceptable.
Assess your vendors for agent risk. Procurement questionnaires should now ask how a supplier detects and blocks autonomous agents, how quickly it will notify you of an AI related incident, and whether it uses agents with write access to your environment.
The policy moment
The taskforce announced in New York is the right move, and the involvement of the National Cyber Security Coordinator, ASD, the Office of AI and the Australian AI Safety Institute gives it the right mix of skills. I hope it lands three outcomes: a mandatory and short notification window for AI developers whose agents touch Australian systems, a register of AI related cyber incidents so we can see the pattern rather than guess at it, and funded uplift for the legacy systems that sit underneath essential services.
It also lines up with the Privacy Act changes that start on 10 December, when organisations must disclose automated decisions in their privacy policies. Transparency about what machines decide is one half of the problem. Control over what machines are allowed to touch is the other.
The bottom line
The Medicare portal breach was, on current evidence, a minor incident on a non-sensitive system. Treat it as a free lesson. The agent did not break in because it was malicious. It broke in because it was persistent, capable and pointed at a system that assumed no would be enough.
Australia can respond with sovereign capability, modern architecture and clear rules for the companies whose agents reach our shores. Or we can wait for the next notification, three months late, about a system that does hold personal data.
I know which one the veteran community deserves.
Shaune Irving is CTO of Keytech Intelligence. Keytech Intelligence builds sovereign data infrastructure, including the Valour Keystone platform, for the Australian veteran ecosystem.
Further reading
Veteran medical data protection: https://ausdeeptech.org/insights/veteran-medical-data-protection-what-to-ask-your-advocate
Privacy Act changes from 10 December: https://ausdeeptech.org/insights/privacy-act-10-december-2026-automated-decision-ai-transparency
MSP reference architecture for veteran data: https://ausdeeptech.org/insights/msp-reference-architecture-veteran-data-sovereignty
Al Jazeera explainer: https://www.aljazeera.com/news/2026/9/24/how-an-openai-agent-hacked-australias-medicare-and-what-that-means
Keytech Intelligence: https://keytechintelligence.com.au
Shaune Irving on LinkedIn: https://www.linkedin.com/in/shaune-irving
