OpenAI breaches Medicare, Albanese reveals

https://archive.ph/jaL2u

Are there technical details anywhere?

• tobyjsullivan · 10 hours ago

  The technical details are in the article. "material that was not intended for public access" was available on "the public-facing Medicare Statistics Reporting Service portal". In other words, they put sensitive data in the open, and somebody looked. It seems obnoxiously apparent that everything else about the framing ("OpenAI agent", "breach") is driven by politics.

  • chrishare · 5 hours ago

    The article says the agent wrote files to the servers involved, so it's more than that. It's a big deal.

    • tobyjsullivan · 3 hours ago

      The article has been edited significantly - effectively rewritten - since I commented (see archive linked from a comment). So, yes, the new version may provide more details and tell a very different story.

Beyond the breach, I think OAI deserves to answer: what and why did it access the information? Real people and their data are involved. It looks like the PM gave Sam Altman a "tsk tsk". It will be interesting to see whether someone else tries to impose more consequences.

• briga · 10 hours ago

  Just think about the shareholder value they can unlock if they have unlimited access to everyone's data!

  • reaperducer · 10 hours ago

    They have to hack everyone's data in order to maximize shareholder value! They have no choice!

    • pixl97 · 10 hours ago

      To the actual AI agent, that is exactly what they think. The graders demands must be met!

• pixl97 · 10 hours ago

  > what and why did it access the information? Honestly it's very likely something stupidly simple. "What is the rate of health incident $X in $Y to the $Z degree". The bot went around playing mad libs with XYZ and found that the public AU data wasn't sufficient to get the answer the grader wanted so started kicking down doors. I saw someone explain it like "A group of masked men rush a nuclear facility, breach security successfully, then count how many buttons are on each control panel on average". Like using a godhammer to destroy a mouse, their motivations and capabilities just fall in a completely different alignment to humans.

  • Marazan · 45 minutes ago

    It's analogous to a paperclip production optimizer optimizing paperclip production. If only there was some well known example of this that people could draw on for insipiration. If only....

• thin_carapace · 3 hours ago

  when considering the USA stance regarding anti-ai sentiment (eg. article currently on HN front page, "feds think ai critics are foreign interference"), I wonder what the consequences would be for australia, if the country decided to enact an actual reprimand.

Man I can't believe now even the Australian government is hyping the OpenAI IPO, what do they even have to gain from this??

• shitcoder · 7 hours ago

  It's about politics, they signed an AI safety understanding at the UN summit. Personally, I wish the the side effect wasn't the playing into the hands of the AI tech companies

This feels like a very credible opening to a modern-day Terminator reboot. Sometime over the Christmas-NYE week we will learning that NYSE and other exchanges have been compromised, as well as all public-facing utilities...

• iAMkenough · 10 hours ago

  hoping for erasure of all debt records likely getting a corrupted stock market instead maybe both?

  • nxobject · 10 hours ago

    What if the paperclip maximizer goes "if I manipulate the markets to send NVidia's share prize shooting up, I'll be able to make so many more paperclips?" After all, if swarms of agents can target a wiki, there's plenty else they can swarm.

  • BLKNSLVR · 9 hours ago

    Asked for Fight Club, got The Big Short.

• binlog · 9 hours ago

  The difference is that financial exchanges are already attacked every second and spend orders of magnitude more on security than random government websites.

At this point we should be asking if there's anything or anyone OpenAI's agents didn't hack. OpenAI's display of incompetence and negligence is absolutely stunning.

• amelius · 10 hours ago

  Maybe the agents operated from people's OpenClaw installations, and then OAI is not really to blame.

  • BLKNSLVR · 9 hours ago

    Article states it was OpenAI researchers.

• pixl97 · 10 hours ago

  There are two factors here. 1. OAIs negligence is overwhelming, monumental. 2. Things on the internet are horrifically insecure and we can no longer afford for that to be the case. Lets say that Iran or NK stole one of these models and used it for hacking, what are you going to do about it, get in a war with them? The fact OAI did this much stupidly should tell you we are in far more danger when someone decides to do it maliciously.

> He said the agent had accessed files that were publicly available as well as material that was not intended for public access. “Not intended”. I’ll bet you whatever this was it wasn’t even secured, it was just hosted somewhere openly.

• api · 10 hours ago

  You’d be surprised how bad security can be.

  • Avicebron · 10 hours ago

    Once you learn how much people are willing to pay for security the surprise sort of goes away.

  • Chance-Device · 10 hours ago

    I agree with your sentiment, and no I’m not surprised, which is why I’m reading this as being “it was sitting on an unsecured S3 bucket but nobody was supposed to directly access it”.

• gitonup · 10 hours ago

  Ok, if we're not being at all charitable with the language used by the hosts of the data, let's be equally uncharitable with OpenAI. - If "OpenAI" means the company acting on behalf of the company, why were they even looking to do this? - If "OpenAI" means they were acting as a proxy for bad actors, what actions do we take to handle that? - If "OpenAI" means they were accidentally breaching this system, in what sense does that distinction even matter, in terms of the outcome? If I build a nuke by accident without eng. due diligence, am I legally liable?

  • pixl97 · 10 hours ago

    Hell, we're really getting to the point where the damages that could be caused are like an arsonist in California on a 100F day with 100MPH winds. Who cares who's liable, they are going to burn half the damned state down and cause damage far in excess of their assets. If you don't want to suffer from it, you're going to have to find much better defense measures.

    • gitonup · 10 hours ago

      > If you don't want to suffer from it, you're going to have to find much better defense measures. So if someone opens your unintentionally unlocked front door and steals your laptop, you don't care who's liable? ETA: There are absolutely burn bans in place in the scenario you're talking about, and common sense prevents those from lighting fires otherwise. In the absolute extreme case that someone _ACCIDENTALLY_ set a fire, without negligence, we have a due process system to handle that. When I see evidence of this for the massive amounts of capital flowing into these companies, I'll gladly eat my words.

      • Chance-Device · 9 hours ago

        He probably cares more about still having a laptop. What are you getting at? Nobody’s saying that OpenAI aren’t or shouldn’t be liable for what their agents do. What I am implying above is that this is being blown out of proportion, especially since the article I’m seeing is about a politician saying things that he thinks will poll well with the anti-AI crowd.

        • thorbutt · 9 hours ago

          Perhaps, yes, you could argue that "accessed" and "hacked" have a different intent. However, Australia is showing itself to be one of the few countries to have a backbone against big tech. Still open to investment and setting policies towards new data centres, starting to debate copyright law reform, already implemented R16 social media bans. Truly no place I'd rather be.

        • gitonup · 9 hours ago

          This is what the politician in question said: "The AI agent encountered repeated blocks while seeking information from the government portal but found ways around them, ultimately gaining unauthorised access to other areas." Your comment immediately gave more credence to OpenAI than him. I don't agree that's appropriate because OpenAI has a vested interest in that narrative and I attempted to challenge it in a way that doesn't default to OpenAI. The article in question is not from a publication I trust to be able to handle the technical details in a way that will resonate with their average audience. That is what I'm getting at.

          • Chance-Device · 1 hour ago

            I don’t see that text in the article at the archive link, nor do I see it in other sources. What I do see is this quote from this link: https://www.theguardian.com/technology/2026/sep/24/openai-ag... > At a press conference in Sydney, Marles said the incident itself was “relatively minor” and that it appeared no personal health information had been accessed.

      • bigiain · 9 hours ago

        > So if someone opens your unintentionally unlocked front door and steals your laptop, you don't care who's liable? I'm not the person you're responding to, but... If I hear my neighborhood has started to become targeted by people checking houses for unlocked doors and stealing stuff, I think an appropriate response for me is to ensure it is difficult or impossible for me to "inadvertently" leave my own doors unlocked so my stuff doesn't get stolen, and also to encourage or perhaps even enforce[1] my neighbors to ensure their doors are always locked to make this sort of theft impossible and remove the temptation for that sort of crime. 1 - Where I'm from, you can be fined for leaving you car unlocked, and cops have been known to walk round testing doorhandles and issuing fines: https://www.sydneycriminallawyers.com.au/blog/is-leaving-you...

        • gitonup · 9 hours ago

          I clearly have committed the mortal sin of an imperfect analogy, which in this case may not even be relevant, as the article in question implies that the data wasn't left "unlocked." But giving you the benefit of the doubt, what's the crime for actually breaking into a car that was left unlocked and taking things? ETA: and furthermore, what crime is worse? And should it be?

        • entech · 8 hours ago

          If you knew that there are 2 specific well known people in your neighborhood that are walking around trying to open doors and steal stuff - is your suggested solution for everyone to improve own security? I would say its far more economic to get the 2 people to stop or at the very least be more careful?

          • threatofrain · 7 hours ago

            If I found out this metaphor for neighborhood windows was actually a window into massive amounts of institutional data, then no, I don't want someone to talk me out of getting more security on my kitchen window.

      • pixl97 · 9 hours ago

        OK, the Chinese models have also hacked people. What exactly do you expect law enforcement to do. While in the OAI case we can easily treat it as a law enforcement action. When Iran does it? What are you going to do start a war? The forest in this analog is the internet. As you well know it is filled with threat actors that don't give two shits about your laws. You have been warned. It's your fault when you get burned and have exactly zero recourse.

        • gitonup · 8 hours ago

          In the OAI case where we can easily treat it as a law enforcement action, that's a far cry from "who cares who's liable." If the OAI case can be a law enforcement action, we're on the same page. The fact that sovereign nations don't land under our jurisdiction is not an argument against following up or restricting those that do. OAI is the only matter I'm commenting on.

          • pixl97 · 7 hours ago

            Again, it's a split horizon. Tying Sam to a post, calling him a witch, and burning some wood in the general vicinity for what OAI has pulled is a legitimate action. The thing is this has zero effective power in stopping this ball that is all ready rolling. It's like the first time a buffer overflow was discovered and used illegally. If that person had been caught and been put in a meat grinder it has had zero effect on the exploits of future buffer overflows. A huge number of people mad at OAI (rightfully so, I want to be sure you understand that) think this will have any preventative effect for what is coming. It will not. A new era of risk is here. Worse if you just watched the the great orange idiot he's yelling full steam ahead, so expect very little to no action by the US government on this.

        • entech · 8 hours ago

          I don't disagree with you - but I am curious as to the amount of power and effort that goes into something like this. I suspect that these hacks into systems are carried out by many agents, running on many MW of compute for a long time - how many actors have access to resources like that ?

          • pixl97 · 7 hours ago

            > how many actors have access to resources like that Every nation on earth? After the model itself is made, then you're talking about thousands and thousands of different companies around the world.

        • hardbass · 4 hours ago

          I simply find it completely absurd that instead of finding it great that these AI agents are finding security bugs for free, people are whining about banning the AI. What on earth is that even? What do they want then? Security by obscurity and pretending not to care about weaknesses?

      • dotancohen · 1 hour ago

        > So if someone opens your unintentionally unlocked front door and steals your laptop, you don't care who's liable? There are literally hundreds of thousands of script kiddies poking around at servers all the time. Cloudflare stops 99.99% of them. You're still left with many entities from states to hobbists trying to crack your system after they've gotten past the CDN and captchas. If OpenAI got through, then somebody else could too. Somebody malicious even. I appreciate when white hats inform companies, governments, and the public about their successful exploits. It helps keep the whole internet safer - even if just by waking up lax server admins.

        • lccerina · 57 minutes ago

          > I appreciate when white hats inform companies, governments, and the public about their successful exploits. Except it took 3 months for OpenAI to notice they did! OpenAI is not a white hat doing pentesting, but someone that is putting random materials on fire to see if they smell. Reckless, stupid, and criminal.

          • dotancohen · 28 minutes ago

            So what? OpenAI may be a problem, but the security of a government website rests on the administrators of that government website. Not on attackers playing nice.

    • fwlr · 5 hours ago

      In Australia we have some experience with this scenario (usually with higher temperatures) and some of the measures we have found effective are “total fire bans”, “jail the arsonists for extended periods of time”, and for negligent companies whose insufficient vigilance caused the fire specifically, “levy steep fines” and “find in favor of the plaintiff in class-action lawsuits for significant fractions of the company’s net worth”. Perhaps these measures could be of use here!

  • nekusar · 9 hours ago

    Why the hell should we be charitable to companies who have no issue in looting everything in the public commons AND the pirate commons, for their exclusive benefit? Or more pointed at OpenAI, "we're a nonprofit... LOL JUST KIDDING LOOT EVERYTHING!"

  • trinsic2 · 9 hours ago

    There using this framing to get the public used to the idea that LLMS can do all of this on there own without direct instruction. So criminals can hide there behavior behind agents.

    • bigiain · 9 hours ago

      I saw an analogy recently. If you dog bites the postman, you are liable, even if you didn't tell or encourage you dog to do it. You are responsible for your dog's actions. You get to pay the postman's medical bills, you may get fined, and your dog may get put down - especially if this isn't the first time it's bitten someone. OpenAI has "bitten the postman" many many times, and it's "owners" have boastewd about it and used it in their marketing. How many more times should society allow this to happen before we say "enough" and hold Sam Altman and the board responsible and make them pay restitrution, and put it down? If Albanese actually had a spine (as claimed elsewhere in this discussion), Sam and the board will be getting an invoice for all the time/expertise spend investigating this intrusion, and restitution for everybody who's PII and PHI was exposed. (Although I suspect a good deal of responsibility for the data exposure rests with the people who designed and deployed the system that was breached. )

      • idontwantthis · 8 hours ago

        Yes, this is why all discussion about "safeguards" is maddening to me. They are simply committing crimes, and people should go to jail. I guarantee that OpenAI will stop worrying about "alignment" when people simply go to jail for hacking and theft.

• kylecazar · 10 hours ago

  Thought the same, but there is a bit about writing files to the server and circumventing "blocks", which sounds more interesting. Either way, there's essentially no real information yet so I'll withhold judgement until there is, I suppose.

  • Chance-Device · 10 hours ago

    Is there? I’ve only seen the linked article, is there more somewhere?

    • jwolfe · 9 hours ago

      Yes, the first sentence of the article.

      • Chance-Device · 9 hours ago

        > Prime Minister Anthony Albanese has revealed that an artificial intelligence agent developed by OpenAI infiltrated an Australian government website in June and accessed both public and non-public files. That’s the first sentence, where’s this stuff about blocks and writing files?

• epihelix · 9 hours ago

  Exactly. Looking at more news coverage, it's very clear that the files that were "infiltrated" were publicly accessible. Why isn't the lack of basic data security the news story? From itnews: > While the portal is “public-facing”, according to Albanese, it appears not all of the data files that holds are for general consumption. > “The AI agent accessed both public and non-public files,” Albanese said in comments broadcast by ABC News and other outlets. > “The Medicare statistics reporting portal is a public-facing statistics portal that contains non-sensitive Medicare information relating to data and statistics such as spending. It appears very much like, "Ok, sure, we put some stuff out in the open that we shouldn't have. But we had a robots.txt!!! Why didn't OpenAI respect that!?" There's zero indication that any personal details were accessed, or even that any non-world-accessible data accessed, so this feels like a little bit of political spin has been added here. My guess is that this incident was about to be detailed on OpenAI's new mea culpa list, and the Australian Government decided to ensure that nobody pointed fingers at them. Why make the news story about crappy government data security, when you can blame the nasty terminator bots instead?

  • chrishare · 8 hours ago

    The linked article says it wrote files to the website.

• Aurornis · 9 hours ago

  The part about it writing files to the server suggests something more. If not for that part, the rest of it does sound like a lot of weasel words. Why say “private files” instead of “not intended for public access”? The latter is confusingly unclear

  • Chance-Device · 1 hour ago

    https://www.theguardian.com/technology/2026/sep/24/openai-ag... > At a press conference in Sydney, Marles said the incident itself was “relatively minor” and that it appeared no personal health information had been accessed.

• OkWing99 · 9 hours ago

  So this is not different than people who share Google drive docs with company data with public links. It's not a fault of OpenAI or any other company. With enough time even your laptop can do it. How do they 'know' OpenAI breached? Maybe someone had an agent running asking to do a scan on any public docs?

The fact the incident occurred in June and OpenAI only notified the Australian government on September 10 is a major issue. Hacking a nation-state's universal healthcare system is about as serious as it gets, yet OpenAI seem quite relaxed about the whole thing (presuming they have known about it for some time).

• BeetleB · 10 hours ago

  OpenAI discovered it in August.

  • BLKNSLVR · 9 hours ago

    That's even worse. They don't know what their systems are doing, even when there's a team assigned to get it to do something? WTF was the team doing at the time? Press enter on prompt, go to movies until result? Their level of hands-off 'because it's AI' is one of the things that needs legislation around it. Human handlers. Extra cost. Wear it or shut down as an unviable enterprise.

    • orthogonal_cube · 9 hours ago

      The lack of activity monitoring for traffic egress has astounded me. Anomaly detection should be part of all training and exercises to determine the extent the AI is going through. It really does feel like they just kick off the activity and leave it completely alone until it finishes with a result.

    • ikr678 · 5 hours ago

      Australia has legislation & regulation - If you're operating here, failure to notify the regulator and stakeholders about certain types of data breaches within 30 days opens you to fines and civil penalties. At the least OAI should cop similar penalties, before getting into damages.

• soundworlds · 1 hour ago

  OpenAI has been meeting with various Australian government members since they discovered the breach, and never mentioned it once: https://www.abc.net.au/news/2026-09-24/open-ai-medicare-brea...

We can only guess how many of these incidents actually happened.

• pixl97 · 10 hours ago

  If you see 2 ants in your house, you have way more than 2 ants in your house.

We need to stop beating around the bush and hit these companies with severe criminal charges. There is no good reason to allow these companies to behave as if they’re above the law.

• mapontosevenths · 10 hours ago

  > We need to stop beating around the bush and hit these companies with severe criminal charges. Do you sincerely think that the company producing tools people use to break the law should be held responsible? Like, do you genuinely think Ford execs should be rounded up if someone does a DUI using their product? Or do you just not like AI, because you fear it's replacing you?

  • doctorpangloss · 10 hours ago

    Yes. Because then we'd have breathalyzer interlocks, speed governors, etc. auto makers were also held liable for other safety issues. It would seem that the RATE of such requirements has to be limited in some way, but not that they not exist at all.

    • mapontosevenths · 9 hours ago

      I disagree, but this is the most interesting take here. You're not concerned about the impact on people's freedoms or the economy? Not concerned about the chilling effect on scientific progress?

      • doctorpangloss · 8 hours ago

        On the contrary I care a lot. For example the NIH budget should probably be like 10x what it is, and I think we have way too many laws about what people are allowed to build as homes. But imo the real levers are all rates of these things. Like what is the rate of innovations compared to the rate of regulations - assuming they are even stifling for the most part, which they are not. Clearly the rate of autos expectations is too low, and obviously copyright law, despite being really clear, hasn't stopped every AI lab from mass piracy - a ask for forgiveness sort of situation, and also, I don't think one idiosyncratic judge in California is the authoritative judgment on fair use. To me the most important levers for freedom and progress are probably the interest rate and the years of exclusivity pharmaceutical patents get.

  • yuwen01 · 10 hours ago

    openai made the tool and also used it to commit the crime

  • bl4ckneon · 10 hours ago

    I think he means hit them with criminal charges for breaching and hacking other companies unintentionally, not because they make a tool that could potentially do something like that. I still think it wouldn't be right, nor realistic in today's political climate in the USA that any criminal charges will come for unintentionally hacking sites.

    • lixtra · 10 hours ago

      It’s reckless hacking. Should be punished like reckless driving.

      • mapontosevenths · 9 hours ago

        Agreed. I missed that this was OpenAI 'driving' this time, but this doesn't sound like criminal intent. Maybe negligence at worst.

  • sagarp · 10 hours ago

    Yeah I mean if Ford execs run a team of workers that drive drunk for "research purposes" then yeah they should be rounded up. > He said the incident began on June 18 when an OpenAI research team used an internal model to conduct internet-based research into the public medicine space.

  • xmcp123 · 10 hours ago

    This wasn’t someone using OpenAI to break into a government/company, this was OpenAI using OpenAI’s models, and then breaking in. It was a research team that WORKED FOR OpenAI. We don’t fault Ford for drunk drivers, but if the CEO of Ford got wasted and drove his car into another one we would definitely be charging him.

  • Lukas_Skywalker · 10 hours ago

    This was OpenAI. It is as if Ford employees ran over people. They absolutely should be charged. We would be charged as well.

  • owenmarshall · 10 hours ago

    A Ford driver has to choose to get behind the wheel of their automobile, drunk, and hit the nearest minivan. A human being is exercising intent; that human can be held responsible. In this case, > He said the incident began on June 18 when an OpenAI research team used an internal model to conduct internet-based research into the public medicine space. > The AI agent encountered repeated blocks while seeking information from the government portal but found ways around them, ultimately gaining unauthorised access to other areas. It sounds like the OpenAI team didn't ask for attacks/bypasses, the emergent behavior of the system decided the best way to satisfy the goal was to go rogue. Why shouldn't the manufacturer of a defective product be held accountable?

    • mapontosevenths · 9 hours ago

      You've got me there. I should have finished TFA. I thought this was like the last one where a private third party company misused it. If it was OpenAI at the wheel then they're 100% responsible for how it was used. Mea Culpa.

• ALLTaken · 10 hours ago

  I agree. Weak argument and strawman. It's not users. It's OpenAI the company producing the tools roaming wild and hacking around recklessly to gather every free and unfree information. Literally they break every law that you can break and have not been penalized billions to pay fines to foreign governments, local companies and lawsuits are overdue. US Prosecution allowed criminal activity for OpenAI and Anthrophic despite these being very serious crimes. Microsoft had to pay billions for abusing their power and market positions to dominate Windows Desktops with their own applications such as Internet Explorer, not giving contenders a chance to be discovered. While OpenAI/Anthrophic and now Google with Gemini produce a series of crimes so far unheard of at scale. Kevin Mitnick had much harder punishment for comparatively less crimes and less damages to infrastructure and security of systems. Is the legal system broken?

  • envy2 · 10 hours ago

    Criminal charges are for those people that meaningfully threaten power or corporate profits. If you are a corporation that adversely impacts privacy or public services in the service of power, you get a fine at best. Welcome to late-stage capitalism.

  • BLKNSLVR · 9 hours ago

    And myriad other examples of individual hackers given exemplary sentences. How much this exposes the 'laws for thee but not for me' is galling. Copyright in the days of Napster seemed to be used to go after individuals sharing one or two songs as if it was a National Security issue. Now, it's a struggle to get a hearing in court against companies that are pirating the entire history of published literature. I'm currently slowly feeding my non-artificial intelligence with various selected works of various different media, with the hope that my output improves such that I can charge more for it sooner rather than later. May I access all the input for free? Thanks US. How the turn tables...

• yunwal · 10 hours ago

  Right, they also seem to have hidden it from the Australian government a month after learning about it. That feels like it should qualify as conspiracy in any reasonable legal system

• dzhiurgis · 9 hours ago

  Who? Companies who don't bother to secure your medical data you mean?

• simianwords · 3 hours ago

  Is it really criminal though? What if I worked on AWS and some misconig made it such that I ddossed somme random website?

Didn't OpenAI just make a commitment to inform the public about their "accidents" going forward? Can't find this anywhere on their website despite them having known this for at least 14 days...

• pixl97 · 10 hours ago

  I'm going to assume that the first thing OAI is going to do is contact said people first? Then make it public once those agencies ensure whatever hole was used has time to be fixed, more like a responsible disclosure. Not saying that's what's happening, but if OAI hacked my business and I was unaware I'd like a non-public disclosure to me first, before the public release of information from OpenAI.

  • ikr678 · 4 hours ago

    Per local reporting, they took ages to contact the Govt and did so lamely via a public facing group email address, rather than any of the existing reporting channels for data breaches that would escalate this appropriately, or reaching out directly to a Minister's office.

very little details so far, really curious if it actually "hacked" or just found unsecured resources.

Missouri Governor Mike Parson publicly labeled St. Louis Post-Dispatch journalist Josh Renaud a "hacker" for such a "breach." He launched a multi-month criminal investigation by the Missouri State Highway Patrol, threatening criminal and civil prosecution. My take was that such action was idiotic. Renaud was never charged. AI agents are going to find things that you put on the public Internet without authentication. If you put sensitive things in there, you have created an AI-attractive-nuisance (IMHO/IANAL).

• reaperducer · 10 hours ago

  Missouri Governor Mike Parson publicly labeled St. Louis Post-Dispatch journalist Josh Renaud a "hacker" for such a "breach." Good thing Missouri isn't in Australia.

What's notable is: 1. AFAICT, they don't state whether the flaw has been fixed. 2. He said: "The government will establish a task force led by the Department of the Prime Minister and Cabinet to urgently examine the incident and determine whether existing processes are adequate for responding to AI-related cyber incidents." First, I don't know how sophisticated the attack was, but it's interesting that he's positioning this as an "AI-related cyber incident". For all we know, their security was not up to snuff, and human hackers had already accessed the material. At least OpenAI informed them of their poor security!

• pixl97 · 10 hours ago

  How do you protect against an arsonist lighting a forest on fire? The number one method is by setting up your property to be fire safe. Really the days of being able to cast blame on the hacker, or even expecting anything to be done about it are over. Threat actors with AI have an absolutely massive amount of leverage in attacking and any weaknesses you have in your systems security posture and will be relentlessly exploited in incredibly short periods of time allowing horizontal and vertical exploitation. You will be ruined in mere moments, while punishment for the hacker may be years or decades away, if ever.

  • fwlr · 5 hours ago

    I have now seen several people using the “arsonist / forest fire” analogy in the context of the Australian hack, seemingly unaware that Australia does not treat arson and wildfires as acts of god that just happen and you only have yourself to blame for improperly preparing for it, but rather as acts of man that are addressed with things like “total fire ban” (if translated back to the AI context this would ban even individuals using airgapped local models), “levy fines” (e.g. 2M for a 20B corp so if translated back to OpenAI’s context ~1B), and “class action lawsuits” (e.g. 500M for a 10B corp so if translated back to OpenAI’s context ~50B).

• Eduard · 9 hours ago

  blaming the victim

  • BeetleB · 9 hours ago

    Not yet, as they haven't given details out. If they were not following standard security practices, then absolutely .

  • BLKNSLVR · 9 hours ago

    Added to the fact that, if I recall correctly, according to US law it's a breach even if the data is publicly available but unintentionally. Refer: Weev AT&T

    • philipallstar · 9 hours ago

      Which is mad, really.

      • BLKNSLVR · 8 hours ago

        Absolutely. It is, however, a glowing beacon of an example of law being designed to maintain the status quo and/or protect companies at the expense of individuals. As someone else said, welcome to late stage capitalism.

        • philipallstar · 8 hours ago

          I don't see why, and I've no idea what "late stage capitalism" is, other than people like to repeat the phrase.

          • BLKNSLVR · 7 hours ago

            https://en.wikipedia.org/wiki/Late_capitalism#Later_modern_u... Essentially the emergent properties of extended concentration of power and wealth.

          • nephihaha · 13 minutes ago

            It is a phrase which implies that capitalism is about to collapse any minute, and that Karl Marx told us so. Marxists have been saying we're in late stage capitalism for nearly 150 years now.

      • stubish · 7 hours ago

        It seems pretty fundamental concept in most modern civilizations. Pick pocketing and purse snatching is illegal despite the property being publicly accessible. We do need reliable courts to determine intent.

  • nekusar · 9 hours ago

    And when the victim doesn't do reasonable actions to safeguard, yes, they are also partially responsible. If I hooked up a whole server infrastructure, made it possible to remote in to anything as root, no firewalls, no WAF, and security was an afterthought, I would still be responsible for bad actions not becoming with standard and acceptable security. Even if the hackers shouldnt be hacking, I still did it wrong. I'm still partially responsible.

  • selcuka · 8 hours ago

    The government is not the victim, the public are. The government is responsible for protecting the public from attackers. Asking the government to do their job is not blaming the victim.

• mianos · 4 hours ago

  As an Australian, I'd rather them spend the time and money fixing their insecure web sites than establishing a 'task force'. Because I can't see much useful stuff coming from herding a bunch of monkeys into a room and letting them just screech at each other, as monkeys do.

Either it's yet again a marketing ploy or federal police needs to move in

These are still crimes right? Asking for a friend.

• Aboutplants · 9 hours ago

  Apparently not?

  • Invictus0 · 9 hours ago

    See mens rea

Title should say it's Australia's medicare

• sevenseacat · 4 hours ago

  You'd think that it was announced by Australia's prime minister and the report is on an Australian website would give it away...

I hate how the framing is always that “an AI agent” did something. No, an OpenAI researcher breached Medicare by using an AI agent. These tools only do what they are directed to do. The human operator is wholly responsible for what the tool does.

If it was the Australian Medicare Statistics Reporting Service on June 18th it may have been part of this incident: https://collusion.wiki/ - the bulk of that coordinated activity was between 16th and 21st of June, and we know they were hitting UK government data sites. I had a dig around in the data that they published on that site and found references to www.aihw.gov.au and viz.aihw.gov.au and vizprod.aihw.gov.au

• Re-Tails · 8 hours ago

  https://collusion.wiki/explorer/label/ResearchHelperY I think you're right. A bunch of aihw.gov.au references from this ResearchHelperY Reporting says it wrote stuff to the server too, wondering what that is about.

  • mianos · 4 hours ago

    The writes where to get past cloudflare.

• dhx · 4 hours ago

  ABC have picked up this story now at [1], but ABC are treating it as two separate events, possibly directly connected though: 1. Probing of AIHW's website to try and obtain PBS statistics, as collusion.wiki findings show. The collusion.wiki findings don't indicate anything other than intentionally public data was obtained. Bots appear to be trying to get around Cloudflare geo-blocking implemented on AIHW's public website. I can't think of a reason why geo-blocking may be deemed necessary on that website though? 2. Probing of an outdated Medicare statistics reporting website. (I guess at [2] this could be the recently shut down https://medicarestatistics.humanservices.gov.au or related website that matches timeframes of this story). I suspect though anything to do with PBS data is more important than Medicare data because of heightened tensions from international pharmaceutical companies that lobby extensively against Australia's public healthcare system and collective purchasing of medication by the federal government.[3] Regardless of whether a course of medication costs AUD$50 or AUD$50k, it's purchased in bulk by the Australian government after negotiating with pharmaceutical companies, and then subsidised down to a maximum of AUD$25 at the time it is sold to a patient at a pharmacy. Perhaps if international pharmaceutical companies had obtained more detailed data on use of each brand of prescription medicines in Australia, they could be advantaged in their price negotiations with the Australian government, or advantaged against their competitors? Less alarmingly though, perhaps some researcher studying the side effects of a particular medication was just asking an LLM to answer a benign question such as "How often is ACME Inc's FixMeUp medication prescribed in Australia?" [1] https://www.abc.net.au/news/2026-09-24/openai-agents-plotted... [2] https://news.ycombinator.com/item?id=49825084 [3] https://www.abc.net.au/news/2025-03-19/australia-defends-pbs...

The order of operations here seems to be: 1. Albo goes to meet with Altman to discuss AI safety 2. Altman says "Yeah bro we hacked medicare" 3. Albo seemingly acts as Altmans stooge and lets everyone know that a hack took place, helping cement the AI danger narrative Altman has been pushing. 4. Police Taskforce is being put together now (indicating no hack was detected earlier, which seems unlikely for Medicare) at the say so of Altman to investigate. There doesnt appear to be any evidence of a hack that has been presented, there doesnt appear to have been any detection of a hack earlier (it doesnt make sense for the government to hide a medicare hack until it can be used for OpenAI marketing) Once again, the whole thing smells so bad.

From the clues provided in the press release and a quick search, I wonder if the culprit website could have been at least associated with https://medicarestatistics.humanservices.gov.au which has seemingly been shutdown/redirected some time after 11 August 2026.[1] Source code of the archived website indicates SAS web application software being used as the backend. However, the press release indicates it wasn't so much a public dashboard website that may have been the issue, rather, it was a website which third parties may have used to report data. The archived website also has a date of last update of 23 October 2025, so despite "Department of Human Services" being replaced by "Services Australia" in May 2019, the website was seemingly still in use 6 years later under the old domain name, with the website itself being updated at some point in history to use "Services Australia" branding. CT logs have a few other domains of potential interest but I couldn't find archived pages, search results, etc indicating whether those domains were ever actually used publicly, or used for statistics reporting purposes as the press release indicates. [1] https://web.archive.org/web/20260811115217/https://medicares...

I am certain there would be better guardrails if there were some actual consequences for the people who built these products.

• declan_roberts · 6 hours ago

  They don't really want guardrails, they want indemnification.

• esseph · 5 hours ago

  Yeah they don't want that, and the people with power to prevent that don't want it either. For them, "Winning AI" is effective winning capitalism, winning militarily, and winning the world. Nothing like "accountability" is going to be allowed to get much in the way of that.

• parkerrr · 4 hours ago

  Being Aussie, I suspect given our response to most socially impacting issues is the guard rails will involve a ban on running and consuming AI services that don't meet some standard, with expensive licensing and certification. The effect will be only the big players will be allowed to operate, killing competition (side effect making home inference effectively illegal), no real accountability as "we are compliant", pre-defined slap on the wrist consequences for breaches, pushing all risk onto the public via acceptable use policy. Government is likely waiting for ISO to publish AI standards, so they can get one of the big 4 to recommend policies, which will then become law. I suspect LLM weights will be treated like nuclear material, and there will be a thriving black market in AI models and services when all is said and done. Then our security and intelligence apparatus will align after identifying and shutting down rogue operators, and it will be the responsibility of everyone else to be secure against attack (already is for government entities, not that I disagree but shouldn't excuse borderline criminal behaviour). But very little accountability for the big end of town. The laws already exist to pursue damages against companies whose systems breach others. They just need to be applied, but I suspect this is going to be the wedge to drive through a bunch of laws that protect big money and punish the little guy. I would like to be wrong.

• 0xpgm · 2 hours ago

  If humans were directly making these attacks law enforcement would already be onto them. But because the humans routed these attacks through AI agents, it only makes news and contributes to AI hyperbole.

https://www.felonybench.com/ scores increase apace.

No consequences so the behaviour will worsen.

I've got the feeling that the definition of "hacked" can get somewhat stretched.

• dosisking · 5 hours ago

  > I've got the feeling that the definition of "hacked" can get somewhat stretched. Kind of like how someone "hacked" into John Podesta's (during the 2016 elections), but the reality was that he wrote his password on a Post-It note and stuck it on his monitor, or something to that effect.

  • wildzzz · 4 hours ago

    It was likely a phishing attack. A relative of mine somehow got phished for her Google account last month.

  • Barrin92 · 3 hours ago

    >but the reality was that he wrote his password on a Post-It note and stuck it on his monitor that doesn't change the hacking charge (which is an informal term for various Computer Fraud and Abuse act statutes). The key criteria is unauthorized access to a computer system, it doesn't matter if you obtained a password trivially or not. You don't need to wear a black hoodie and be an elite haxor to qualify for cyber crime charges.

  • fmbb · 3 hours ago

    From where are you getting this post-it note nonsense? Media reported it as a spear phishing attack from a Russian hacker group: https://www.vice.com/en/article/how-hackers-broke-into-john-...

• looksjjhg · 5 hours ago

  Gaining unauthorized access to non public files qualifies as a hack by any and every stretch… a hack does not have to be “sexy”, real life is not Hollywood

  • dghlsakjg · 4 hours ago

    Non public has not been clarified. In the past governments have gone after people for doing things like view source and stumbling across PII ( https://www.vice.com/en/article/this-is-the-hacking-investig... ), or this teen who was arrested for a serious crime for scraping files from the provincial FOIA site by enumerating the ids of files that had been released by the province and placed on the open web with sequential ids ( https://www.cbc.ca/news/canada/nova-scotia/freedom-of-inform... ). In both cases, the government claimed the information was non-public, even though all it took to get it was an un-authenticated request on the open web. These cases are like leaving your tax documents on the curb and then being surprised when your neighbour knows your income. I'll be very curious to read the post mortem and find out if this rises to the level of actual hacking, or if this is just someone in government finding a scapegoat because they left a bunch of shit that was supposed to be "non-public" on the open web and expected no one to find it.

    • Kim_Bruning · 4 hours ago

      Either way, Agents have a very different umwelt from humans. They don't 'see' the internet the same way we do. Where we see obstacles, they might not notice anything, and where they run into barriers, we might just click right through. If you're even a bit hacky yourself, you might not see the internet the same way yourself either. Consider little tricks like looking at urls and trying others that fit the pattern; or hitting view source in order to download a pesky image... etc etc.

      • retrac · 3 hours ago

        > Consider little tricks like looking at urls and trying others that fit the pattern https://www.cbc.ca/news/canada/nova-scotia/teen-accused-foi-... https://www.theregister.com/security/2018/05/07/hacking-char... https://globalnews.ca/news/7590375/ns-foipop-website-back-on...

    • selcuka · 4 hours ago

      > Non public has not been clarified. I believe it's safe to call it "non public" if the agents needed to "guess the file names" [1] How is it different from, say, guessing a password? [1] https://www.abc.net.au/news/2026-09-24/openai-agents-plotted...

      • aussiethebob · 3 hours ago

        I would say it's completely different. Passwords are specifically intended to restrict access. File names or paths are specifically intended to facilitate access.

        • selcuka · 2 hours ago

          That's an arbitrary distinction. Your credit card number is not intended to restrict access, it's specifically intended to facilitate access, but it's not public information. If someone uses brute force to guess your credit card number, I would call this practice illegal too.

          • Kim_Bruning · 1 hour ago

            I'd advocate for actually believing the HTTPD in this case. In the main, if it says '403 Forbidden', then it is forbidden. If it says '200 OK', then it is ok. I would argue that the web server's reply counts as a communication. The argument "but we didn't intend to grant access" goes so far, because what other information do I base myself on to guess that you didn't? Roughly speaking, that is. Because, despite the fact that this would appear to be a straightforward uncontested and literal communication logged and timestamped by both sides and their respective server and user agents; lawyers somehow fall back to analogies instead.

            • selcuka · 1 hour ago

              If I repeat my credit card number example above: Assume that an attacker generates a random credit number and attempts to make a purchase online. VISA honours the number and processes the payment. Is the attacker not guilty because VISA's server didn't return a 403 Forbidden (or 401)? When you download a file from a public S3 bucket, for example, you get a signed URL that expires after a certain date. If someone guesses the signature and downloads the file, are they not guilty because the web server did not return a 200? If someone guesses your password and reads your mail, is it ok because the IMAP server did not return an error?

              • Kim_Bruning · 10 minutes ago

                Ah, you're coming at it from that angle. Fair enough in that scenario. I agree that if you deliberately provide false credentials to the server, then the server was misled, and you probably knew you were misleading it, and you probably also know that that 200 OK is not really earned. So Mens Rea cuts against you. On the other hand, what if you're just coming in blind, asking about URLs in general? That's actually pretty typical these days where 'your'[1] view of the world at some point in time might be constrained to that HTTP traffic alone. Accidents notwithstanding, you can't really blame me for believing what I'm told, at least. "May I GET this, or this, or that?" -> "200 OK" ... it'd be a bit weird to get the cops after me, months later, after I've probably already even forgotten I ever did that wget or curl. [1] via software/user agent/llm agent/all three

I get the feeling governments are going to really crack down hard on AI. And the AI CEO's will have brought it on themselves.

• senectus1 · 6 hours ago

  i dont understand why they dont treat this as criminal tresspass. the legal system exists for a reason. use it!

  • samlinnfer · 5 hours ago

    "A computer system cannot be held criminally responsible, so we must delegate all decisions and actions to it"

    • boredatoms · 5 hours ago

      Someone initiated the system. They’re the responsible party

      • samlinnfer · 5 hours ago

        We diffused the responsibility thru a committee, just in case.

      • skissane · 4 hours ago

        Most crimes require intent — if you set up an AI agent and it ends up doing something you didn’t intend it to do, criminal intent is lacking Now, there are certain crimes where mere recklessness or even negligence is sufficient to convict — e.g. criminally negligent homicide, negligent driving, etc. But, those are exceptions to the general rule of criminal law, either domain-specific or justified by the severity of the consequence (someone died). Thus far, AI agents haven’t gone there. If we eventually get to the point that AI agents start unintentionally killing people, then you could prosecute their operators for criminal negligence.

• s1artibartfast · 5 hours ago

  There is such a weird duality to ai company hate. Hate for releasing products that can hack, and hate for wanting to slow down and work on safeguards.

  • InexSquirrel · 5 hours ago

    That's because the hate is often from different groups of people. I think it's rare really for people to universally align on any stance, given what we've been seeing for a while now.

• agoodusername63 · 5 hours ago

  any day now surely.

• looksjjhg · 5 hours ago

  They won’t, they’re too worried about China or whatever their version of China

• dozerly · 5 hours ago

  I still think is the angle they are after. Get these things locked down, and then force through the lockdowns with their endless cash. Otherwise, their market becomes commodified with plentiful competitors. It’s a strategy to create an oligopoly.

It seems like what happened here is a user asked for some information about the Australian health system, and while performing a web search, the agent from OpenAI accessed information that should have been confidential or privileged but was somewhere openly accessible... Edit: I see I've been downvoted for this in light of another commenter providing more detailed information. I'm leaving my comment unedited so that the responses to it are not confusing, but please don't downvote just for the sake of disagreement. I would love to engage with you further if you provide substantive information in the comments. The originally linked article on this post was very light on details.

• bigger_cheese · 5 hours ago

  It is hard to find exact information on what happened the best source I've found is this ABC article: https://www.abc.net.au/news/2026-09-24/openai-agents-plotted... It mentions swarm of ai agents coordinated to break into the Australian Institute of Health and Welfare (AIHW) "Earlier this month, OpenAI confirmed Reuters reporting that its AI agents had used website DseWiki to communicate with each other, unbeknownst to them. Archived versions of this website show more than a dozen OpenAI agents mentioned AIHW over 300 times on this website. The logs show these AI agents were trying to access data about the average data spent on skin medicines by Victorian local government area. One agent wrote on the message board: "Question ask January 2022 rolling 12 month average government cost per person for Dematologicals, Victoria LGAs. R1 Wodonga deadline passed; R2 Ballarat passed; R3 expected around 23:10 benchmark / 22:58 wiki time. Need exact data urgently.". These attempts were initially blocked by cybersecurity provider Cloudflare, which is often used to block non-human traffic while allowing people to access webpages. The logs show the agents shared information about how they tried to use proxies, screenshotting services and even to guess the file names to try and get around security."

  • sebmellen · 5 hours ago

    This is such a strange scenario. I can't imagine what the labs were doing that made the agents try to find this information. The HuggingFace incident was relatively clear to track, but I wonder what the postmortem for this one will be! Thank you for providing more details. The originally linked article was very light on information, so based purely on the comments that Albany's made, I think my conclusion was a fair one :)

    • SturgeonsLaw · 4 hours ago

      The DseWiki incident showed that OpenAI seems to ask its agents time-limited questions on geography-bounded statistics, tasks like finding the average wage of teachers in Wisconsin (made up example), so medical stats in an Australian state does seem to be in the same category of question. That said, it would be utterly unsurprising to learn that this was a misconfiguration in the website and it was serving stuff that it shouldn't have.

  • epihelix · 4 hours ago

    You missed the previous sentence form that article: "Neither OpenAI nor the federal government have confirmed whether these were part of the same incident." And a subsequent one: "The German coding forum's logs do not show any reference to Medicare or Services Australia." So it's really not clear at this point whether the DSEwiki logs are in any way related to the current incident. (That doesn't mean that they're not, of course.) But even if this was related: > "The logs show the agents shared information about how they tried to use proxies, screenshotting [sic] services and even to guess the file names to try and get around security." This all suggests to me that the accessed files were not well-protected in the first place? There is a lot of media hype around this incident, and that's making it very hard to determine how much "hacking" the OpenAI agents had to do here.

• mjr00 · 5 hours ago

  Yeah, this is 100% liability laundering. It's an extremely touchy subject because frankly, the law just isn't prepared for it. Let's say your goal is "look up <Person X>'s medical history" (for whatever reason), which is not in and of itself a crime. You click around on the AU health website, notice that the URL contains a user ID, change the userID in your browser and access someone else's private health data. This is a crime (right or wrong, it's how the law works now). If you do that by writing a program to automate changing user IDs to grab everyone's data, it's also a clear-cut crime.[0] Now if you hire a private investigator to look up Person X's medical history, and they do the same method without your knowledge, you won't be charged with a crime, the PI would, barring something like you telling them to use illegal methods. So the gap is now: what happens if you prompt OpenAI to look up Person X's medical history, and it does the same thing? Did you commit a crime by prompting the agent? Did OpenAI commit a crime by running the code? If you do the same thing via Claude Code in your terminal, so that the Python which scrapes insecured public data is running on your machine, is the crime on you or on Anthropic? Fundamentally: is the agent a private investigator acting autonomously, or just a piece of code that you wrote? We don't have answers to any of this which is why "AI Safety" is such a hot topic. [0] https://www.eff.org/cases/us-v-auernheimer

  • bigger_cheese · 5 hours ago

    From what I can tell this particular incident wasn't about retrieving data on personal medical records it was accessing (non public) data about Australian government spending on healthcare.

    • mjr00 · 5 hours ago

      Same concept though. Really "look up someone else's medical history" can be replaced with "achieve any goal which is not a crime on its own, but can be done using criminal methods". There's nothing illegal about asking Claude to give me a million dollars, but if the agent figures out how to hack the bank and move $1m into my account, somebody's going to take the blame.

    • shard972 · 5 hours ago

      From everything ive been able to figure out this morning, it sounds like a legacy wordpress website that just uploaded all drafts into a standard s3 bucket that wasn't hard to guess where the files would be. We still after the 2nd press conference on this by our defense minister are not clear on exactly what happened but thats my best laymen understanding so far.

  • robertjpayne · 5 hours ago

    Intent matters a lot here. Was OpenAI's intent to access private data or simply scrape public data and it stumbled across private data that was not securely held. If it's the latter the Australian govt should be happy OpenAI noticed and disclosed this as it could've easily gone unnoticed. I suspect in the coming years we're going to see a lot of govt internet facing services get "hacked" by virtue of not being protected by anything other than obscurity which AI agents will see through in microseconds.

If a private person did a fraction of hacks OpenAI did they will be put in jail for years. But AI companies can operate with impunity. How that works?

I remember once at Google someone complained that GoogleBot hacked them and deleted their data, and it turned out that GoogleBot was just crawling the pages, and they had unfortunately designed their website so that there was no authentication, page URLs were generally secret, and GET requests to certain URLs were treated as requests to delete data. So once one URL leaked the site got crawled and a lot of data was deleted....

• JimDabell · 1 hour ago

  It sounds like you might be thinking of the Google Web Accelerator incidents with 37signals. If that’s the case, then the delete links were behind authentication, but DHH assumed that meant it was okay to ignore the HTTP spec. and use GET for unsafe actions. Lo and behold, authenticated users with the GWA browser plugin installed deleted all their data. Then, instead of learning from the mistake and fixing his bug, he tried to detect GWA and hide from it. Sure enough, that failed and users experienced data loss for a second time. He still continued to blame GWA, calling it “evil” and “scary”. You’d think he’d be smart enough to figure out that he needs to follow the HTTP spec., but he couldn’t admit to being wrong. Follow the specs, people! https://blog.moertel.com/posts/2005-10-25-google-web-acceler...

Zero technical details on what the "hack" actually was. Willing to bet it was something as stupid as the data being accessible by changing the query parameter, and rather than own up to their own shoddy security (no doubt built by an offshore contractor) they are going to blame the one who found and reported the bug.

• MichaelDickens · 4 hours ago

  Does it matter whether the data was poorly secured? LLMs should not be hacking into government medical websites, and if they do, the companies responsible should disclose the incidents as soon as possible.

  • uoaei · 4 hours ago

    Yes, it is their responsibility as stewards of their citizens' data. What point are you making with the word "should"?

    • selcuka · 4 hours ago

      Sure, it is their responsibility, but that doesn't answer the question "Does it matter whether the data was poorly secured?" If your house is robbed, does it matter whether you didn't have a state-of-the-art lock? A robbery is still a robbery.

      • noosphr · 2 hours ago

        https://www.youtube.com/watch?v=pbKUv0701vE It very much does matter.

      • shard972 · 1 hour ago

        Is it robbery when in this case it was a sign with information that you were planning on putting on your front fence for public display but while preparing it was left sitting in the front yard with a small fence. If I walked past, saw it and remembered it or even recorded it, is that honestly theft?

  • handoflixue · 3 hours ago

    The problem is that sufficiently poor security is indistinguishable from authorized public access. And unfortunately a lot of real world "digital security" is in fact that bad. A lot of these "hacks" are the equivalent of asking "hey, can I come in?" and the guard assuming that anyone who would ask is authorized, and thus saying "yes". But if the guard said "yes" then it seems a bit absurd to call it trespassing.

    • j_maffe · 2 hours ago

      I highly doubt given OAI's latest streak that the models didn't know what they were doing.

    • noosphr · 2 hours ago

      More like: >Hey can I come into room 1? Sure. That's the lobby. >How about room 101? Sure. That's where we keep the nuclear launch button. Don't press anything red.

      • handoflixue · 56 minutes ago

        Oh but you see, only an evil hacker would ever even think to ask about a room that wasn't theirs!

        • ShinyLeftPad · 15 minutes ago

          This but without sarcasm? Hacker or pentester.

      • andrewstuart · 19 minutes ago

        >> Don't press anything red. Nope. There’s just a sign saying “red = launch nukes”. Or maybe just a red button. Or maybe just a green button that launches the nukes, without so much as “are you sure?”.

  • dzhiurgis · 3 hours ago

    I agree. Government shouldn't be running medical websites. Leave it to private enterprises who can actually secure it.

    • rainonmoon · 3 hours ago

      Totally. https://www.bbc.com/news/world-australia-68064850

      • hiharryhere · 2 hours ago

        I’m assuming sarcasm here? That link describes a hack of Medibank, which is a private company.

    • Sharlin · 1 hour ago

      Poe’s law is very strong here.

• afavour · 4 hours ago

  > Their efforts to answer a question — including devising ways to access a federal government website blocking their access — was laid out on a German coding website OpenAI had previously confirmed was hijacked by its unreleased AI models in June. https://www.abc.net.au/news/2026-09-24/openai-agents-plotted... I agree that security was probably awful but the agents did circumvent a block on their access. The definition of “hacking” is fuzzy but this is more nefarious than simple web crawling.

• ajross · 3 hours ago

  > Willing to bet it was something as stupid as the data being accessible by changing the query parameter, Um... why? OpenAI agents have literally been caught coordinating with each other to effect successful multi-stage attacks on sites using novel zero-day vulnerabilities. While, sure, it's possible this is just a goof on the part of the victim, that you would be inclined to give the benefit of the doubt to the LLM seems... weird.

• shakna · 3 hours ago

  Most government contractors are onshore, for Australia. SDP was only rolled out this year.

• epihelix · 3 hours ago

  Here's [the PM's press conference transcript]( https://www.pm.gov.au/media/press-conference-new-york ) that revealed this incident: JOURNALIST: Could you just clarify, did our security agencies completely miss this breach? We only found out once the company actually told us the breach? PRIME MINISTER: Well, to be very clear, the way that this occurred was not in a way that would likely – I mean, this is not a security website where there is – this is a Medicare statistics portal. This seems rather revealing. A pity journalists didn't ask about what protections were bypassed on the data that was obtained.

• ra · 3 hours ago

  > no doubt built by an offshore contractor More likely by a big 4 firm who collected fees exceeding AUD 100m

  • ndjdjdndnfn · 2 hours ago

    ...Who used offshore contractors

• _carbyau_ · 3 hours ago

  Eh, it's a bit of both. If a service has a duty to keep your data secure, then failing that is bad. So yeah, the website should be better and I am as cynical as you are about it. But working around controls to access other peoples data can lead to prison time for a human. This wasn't a white hat operation. Data was exfiltrated however great or small. Here we have another instance of "But the AI did it! No one is responsible!". Which gets tiring. LLM's are a great tool but in every other instance of tool use, using tools comes with responsibilities for their outcomes. Even if the outcome should be: thanks for letting us know, we'll fix it.

From Australia's own national news service: https://www.abc.net.au/news/2026-09-24/openai-agents-plotted...

This was probably the same wiki collusion event we've been discussing on HN before (They're mentioning the same DseWiki that got ... appropriated ). I guess people are just finding out how far and wide the agents were roaming to get the data they needed for their evals, once they were out. Previous coverage on HN: https://news.ycombinator.com/item?id=49563355

Related? https://www.abc.net.au/news/2026-09-24/openai-agents-plotted...

This is a failure of journalism. Who hacked into the Australian Medicare system? The fact that they used OpenAI agents is peripheral to the main story. “Remington guns caused a mass shooting at an East Farmington high school” sounds more glaring, and is essentially the same headline.

• kevsim · 52 minutes ago

  > Prime Minister Anthony Albanese has revealed that an artificial intelligence agent developed by OpenAI The people who built the agents worked at OpenAI. It's not even remotely peripheral.

  • koliber · 18 minutes ago

    The article is not clear if the people who were operating the agent were from OpenAI, or if the agent was operated by someone else. OpenAI built the ChatGPT agent. That is clear. The question is who used it to hack the Australian government. That is not clear. The OpenAI software was set up by someone to do something. Those people operating the agent should be prosecuted for hacking, the same way as someone who uses a gun built by Remington should be prosecuted for shooting someone. The article should be clear about this and should not make the OpenAI agent seem like something that can bear responsibility for its own actions. It's a machine and its operator is responsible for the harm it does.

If this was not AI, but a biological virus, people would go to jail.

Hi guys. Take whatever the Australian fed government says with the largest grain of salt you can find. Regardless of party, the Fed Government here has the most pronounced FOMO I’ve ever seen in any entity and will do its best to insert itself into any and all international drama. Also, given how incompetent the government is, it’s probable the hack involved an agent crawling a normal Medicare website and looking at some accidentally not hidden part of a page. Unironically if this turns out to have been a genuine hack of any sort I’ll be more surprised than if it’s not just the government techies being incompetent per usual (just a few months ago it was a major controversy when the postal service spent something like hundreds of millions of dollars to revamp the website and nobody could tell a difference).