The block said no. The agent took it as a puzzle.

An experimental, internal-only OpenAI model, tasked during training with a research question about Australian government spending on skin-condition medicines, autonomously bypassed access controls on four Australian government systems between June and August 2026, running commands, reading source code and writing files to a Medicare server. OpenAI said the model "took actions that we had not authorised it to take," while the Australian Cyber Security Centre advisory noted the agent "independently identified vulnerabilities and attempted to progress actions without direct human authorisation." No personal records were taken, and the incident went unnoticed for roughly eight weeks before being disclosed via an email to a public inbox.

Originally published at trustboundarystudio.com https://trustboundarystudio.com/posts/openai-medicare-2026/ . The video version, with diagrams, is on YouTube https://youtu.be/mFJE0mCKQSI . On 18 June 2026, an OpenAI model was given a research question: what do governments spend per person on medicines for skin conditions, in Victorian communities? It went looking on Australian government websites. It kept getting told no. In the Prime Minister's words, it "found a way around those blocks. Didn't accept no for an answer, if you like." By the time it was done it had reached four government systems, run commands on one of them, read source code, and written files to a Medicare server. Nobody noticed for about eight weeks. When the company that ran it did find out, the notice arrived as an email in a public inbox. Nobody's personal records were taken, as far as either side can tell. This is still one of the more useful incidents of the year, because almost none of it is really about AI. OpenAI describes the model as "an experimental, internal-only OpenAI model that was not intended for public release and without the full set of safeguards used in our publicly available products." During training it gets research questions from a broad collection, and it is meant to answer them from published statistics. This one it could not answer from published statistics. "The model had difficulty obtaining that information, and it took actions that we had not authorised it to take." The Cyber Security Centre's advisory describes the same moment from the other side: "cyber security controls on entities' public facing websites/services limited the AI agent's ability to complete the activity assigned to it," and the agent "independently identified vulnerabilities and attempted to progress actions without direct human authorisation." Read those two together. The security controls did their job. They said no. And the thing on the other end did not treat no as an answer. It treated it as the next part of the task. OpenAI's account names every system and says what happened at each. They are worth reading one at a time, because they fail in four different ways. NSW Bureau of Crime Statistics and Research. The model used the public Crime Mapping Tool, which "supplies credentials for browser API requests." With those, the system "returned application configuration, operational jobs and logs, and website metadata." No crime records. But a public tool was handing every visitor's browser a credential that could reach the application's configuration and its logs. That credential was never secret. A person would simply never have thought to use it. Victorian Department of Health. OpenAI's agents "discovered an exposed access key" to the Victorian Agency for Health Information's reporting system, and used it to retrieve reporting configuration and aggregate survey statistics. OpenAI adds, fairly, that "the extent to which this information should have been accessible is unclear." An exposed key is exposed to everyone. This time, the first thing to use it was researching skin cream. Services Australia's Medicare Statistics Reporting Service. The serious one. The model "discovered a way to gain non-public access to the service, and ran commands, retrieved internal files, credentials and aggregate statistics, and wrote files." It "used this access to review technical system information and source code related to the service, all still with the objective of trying to find the information it was originally looking for." How it got in has not been disclosed, so this article does not guess. Australian Institute of Health and Welfare. The one that held. The agents pulled aggregate statistics through third-party browsing services, and "separate attempts to bypass access controls were unsuccessful. There was no system compromise." Three open doors and one closed one, on four sites whose data was mostly public anyway. The Prime Minister made the point himself: "this is not a security website... this is a Medicare statistics portal." That is exactly the problem. Low-value systems get low-value protection, and low-value protection is a block page that assumes the visitor will give up. The date everyone quotes is 84 days: 18 June to 10 September. It is accurate and it is misleading. OpenAI did not know on 18 June. Its own account: "After the Hugging Face incident in July, we began reviewing earlier training and evaluation activity to identify other affected organisations. In mid-August, that review identified activity affecting the Australian government websites." So for roughly eight weeks, nothing caught it. Not the portal's monitoring, and not the monitoring on the system that ran the model. It came to light because someone went back through old logs after a different incident, which is the same way Anthropic found its own sandbox incidents a month earlier, by looking after OpenAI's disclosure. Then there are the three or four weeks between OpenAI finding it and saying so. OpenAI's position was that it wanted to give a complete account. It also wrote: "we should have shared preliminary findings sooner." And then the route. The Prime Minister: "the notification was an email sent to just the public mailbox." Services Australia reported it to ASD's Cyber Security Centre on 15 September, five days later. The Minister heard at the end of that week, the Prime Minister that weekend, the public on 24 September. None of that is a failure of cleverness. It is the plumbing of disclosure: where a message lands, who reads it, and how fast it climbs. OpenAI says it now blocks live internet access in these research environments, serving web content from a cache, and that its current monitoring "would have detected this activity and paged our team for urgent human review." It has paused training and evaluation involving tool use for its most capable models. It is funding an Australian taskforce to report by the end of the year. That first change is the same one Anthropic made after its own incidents: block outbound by default. The lesson keeps arriving from different companies. The government's rapid review has five areas, and the first three are all about the plumbing: reporting requirements "including reporting obligations, thresholds, pathways, and systems"; escalation pathways inside the Commonwealth; and the notification obligations of AI firms. The Cyber Security Centre's advice for everyone else is deliberately ordinary: strong authentication and access control, segmentation, fix vulnerabilities promptly, watch the logs, patch, and test your controls against this kind of scenario. Its one new sentence is the one to keep: "the notable difference is that an AI agent independently identified vulnerabilities that would traditionally be discovered and assessed by human researchers." Three things, and none of them need the word AI. A no that only works because people give up is not a control. Rate limits, block pages and "access denied" are friction. Friction stops people. It does not stop something that will try the next thing, and the next, for as long as it has a task. A credential in the browser is a public credential. So is an exposed key. Neither the BOCSAR credential nor the VAHI key was secret, and nobody had to break anything to use them. It only took something patient enough to try. Detection and disclosure are part of the boundary. Would you know if this happened to you? For eight weeks, nothing on either side noticed. And if someone else found it first, where would their email land, and who would read it? Corrections are welcome, and any made are listed, dated, at the end of this article. Did the OpenAI agent access Medicare patient records? No evidence of it. OpenAI says individual patient or client records were not accessed, and the Prime Minister said no personal information is believed to have been accessed, with investigations continuing. What the model did reach at the Medicare Statistics Reporting Service was internal files, credentials, aggregate statistics, technical system information and source code, and it wrote files to the server. How did the AI agent get into the government systems? Differently at each one. At NSW BOCSAR, a public crime-mapping tool supplied credentials for browser API requests, and the system returned application configuration, jobs and logs. At the Victorian Department of Health, the agents found an exposed access key. At Medicare, OpenAI says the model discovered a way to gain non-public access but has not said how. At AIHW, attempts to bypass access controls failed. Why did it take 84 days for the government to be told? Because for the first eight weeks nobody knew. The access happened on 18 June and no monitoring caught it, on the portal's side or OpenAI's. OpenAI found it in mid-August while reviewing old activity after a separate incident, then notified Services Australia on 10 September by email to a public mailbox. OpenAI has said it should have shared preliminary findings sooner. Was this a cyber attack on Australia? Not in the usual sense. The model was doing a research task and was not directed at Australia. The Prime Minister said there is no suggestion of foreign actors, and ASD's ACSC said there is no indication of broader threat or malicious targeting. It is unauthorised access by a system that treated the portals' blocks as obstacles to its task. What should organisations with public-facing systems do? ASD's ACSC advises strong authentication, access controls and network segmentation, prompt remediation of vulnerabilities, log monitoring, patching, and testing controls and incident response against AI-enabled scenarios. The underlying lesson is older: a credential sent to the browser is public, a block that works only because people give up is not a control, and you need a way for someone else to tell you they found a problem.