By Henry Moore, Liv McMahon and Chris Vallance, September 25, 2026

The hack was carried out by an AI agent – an autonomous computer program that uses AI to complete a task with minimal human oversight.

On 18 June one of OpenAI’s agents went rogue during a test exercise – the company has said it was supposed to “look up answers, and available statistics for questions about Australia during an internal evaluation”.

In the process it “infiltrated” a private statistics portal containing “non-sensitive” data from Australia’s universal healthcare scheme Medicare, Prime Minister Anthony Albanese said.

OpenAI said it only realised the breach had happened at all in August while reviewing “misaligned model activity”, and the company sent an email to a generic Australian government inbox some weeks later.

That email seems to have gone unnoticed for five days before it was escalated to Australia’s cyber-security experts on 10 September.