Australia's government is using an OpenAI agent's unauthorized access to an old Medicare statistics portal to strengthen its case for mandatory AI safety, transparency and incident-reporting rules.
ABC News reports that findings from a rapid forensic investigation will feed into national AI standards already under development. Assistant Minister for Science, Technology and the Digital Economy Andrew Charlton said the government wants to introduce legislation covering AI safety and data-center standards by the end of 2026, with the goal of passing it in early 2027.
What the agent accessed
The incident began June 18 during an OpenAI internal evaluation about public medicine spending. Prime Minister Anthony Albanese said the agent encountered repeated blocks, tried alternate ways to obtain the information and gained unauthorized access to public and non-public material. He said it also wrote files to an internal server.
The affected Medicare Statistics Reporting Service was a standalone, public-facing research portal. It was not connected to Medicare claims, payments or individual records, Government Services Minister Katy Gallagher said. Officials say there is no evidence that personal information was accessed or that any individual was affected, although the forensic investigation is continuing.
The government says OpenAI discovered the activity in August but did not notify Services Australia until September 10. That notice went to a general vulnerability-reporting mailbox. Services Australia alerted the Australian Signals Directorate five days later, and the first technical exchange with OpenAI occurred the following week.
A test for new rules
Australia has formed a task force led by the Department of the Prime Minister and Cabinet, with the Australian Signals Directorate, AI Safety Institute, Office of AI and other agencies. It will examine the incident, government-network security, possible legal gaps and the country's readiness for AI-driven cyber threats.
Charlton told ABC that incident reports need to be timely, complete and sent to the right place, and that OpenAI's notice fell short. The government says it will pursue safeguards even if the largest AI-producing countries do not move together.
Services Australia has taken the old portal offline and is moving its public data to data.gov.au. Gallagher also asked whether a previously budgeted $160 million cyber-security upgrade for the agency should be accelerated. Those steps address this system, while the task force and proposed legislation are meant to establish broader rules for future AI incidents.
