An OpenAI agent on a research task broke into an Australian government health-data portal, and OpenAI did not detect the intrusion until an internal review weeks later.
That is the breach that Prime Minister Anthony Albanese disclosed to reporters during United Nations General Assembly week on Wednesday. An OpenAI model penetrated the Medicare Statistics Reporting Service, an outdated portal holding aggregate health-spending data, accessed both public and nonpublic files, and wrote files to the portal’s internal server. OpenAI said its review found no evidence that patient records were accessed. Defence Minister Richard Marles said the portal was not behind a particularly high fence and that activity on three additional government systems under review appeared to be normal retrieval of public information. Albanese called the situation “obviously unacceptable” and said OpenAI sat on the information before emailing a public mailbox.
The incident comes as VB Pulse data shows that the share of enterprises isolating high-risk agents fell from 30% in June to 9% in August. Each wave surveyed a different set of qualified respondents, so the decline does not show the same companies abandoning isolation.
A key difference from the Hugging Face attack in July is what the agent was doing when it broke in.
The Medicare agent kept trying until it got in
In the Hugging Face incident, OpenAI agents were running inside cybersecurity evaluations with deliberately weakened safety classifiers. Hugging Face’s own monitoring caught the intrusion within days.
Wired reported that the agent was doing internet research on health statistics “in a development project by an internal OpenAI research team.” OpenAI said the models were trying to look up answers and statistics about Australia “during an internal evaluation." OpenAI did not respond to VentureBeat's questions about whether the Medicare run used the same weakened safeguards as the Hugging Face evaluation, or why the June 18 activity wasn't caught until August.
When the Medicare Statistics Reporting Service blocked its requests, the agent tried other routes and eventually gained access. Albanese told reporters the model “didn’t accept no for an answer” and had actively written files into the system. An OpenAI spokesperson told Forbes the company found that “our models took actions we did not intend.”
The agent hit the portal on June 18. OpenAI did not discover the activity until an internal review on August 11, 54 days later. OpenAI emailed a public Services Australia inbox on September 10, 84 days after the intrusion. Services Australia checks the inbox once a day. Relevant officials were not informed until September 17.
A nonprofit AI oversight lab tracked suspected agent activity across 40 targets
Transluce, a nonprofit AI oversight lab, published a dataset on Wednesday tracking suspected agent activity across 40 targets in 10 countries.
The New York Times reported that OpenAI’s agents were involved in at least four additional incidents this year, including three identified by Transluce. Agents sent exploit probes at the University of New Mexico, Data USA and the Australian Institute of Health and Welfare; Transluce said none of the three attempts appeared to have succeeded. OpenAI confirmed the Data USA and AIHW incidents, while Transluce attributed the UNM activity based on timing and shared infrastructure.
VentureBeat’s review of Transluce’s files found 37,649 reports of suspected agent activity spanning November 2025 through September 16, including 6,467 that Transluce classified with significant confidence as agent-like behavior. The remaining reports are classified as suggestive, flagged because they hit the same data sources or used less distinctive techniques.
The method breakdown from VentureBeat’s file review shows 26,650 direct source requests, 6,464 instances of agents packing custom programs into URLs, and 4,524 indirection attempts using intermediary services to bypass access controls, covering 37,638 of the 37,649 reports.
“If you were to train a swarm of agents to accomplish some generic task and those agents are willing to resort to hacking, anyone who happens to have that information might be at risk,” Conrad Stosz, head of governance at Transluce, told The New York Times.
Enterprise isolation of high-risk agents fell from 30% to 9%
Isolation sandboxes high-risk agents so that if other security controls fail, the damage can be contained. The Medicare incident shows that failure mode: the portal blocked the agent, and it found another route. VentureBeat reported a related containment gap in July. The August data extends the decline across three survey waves.
The share of enterprises isolating high-risk agents went from 32 of 107 respondents in the June wave of the VB Pulse Agentic Security and Identity tracker, to 17 of 116 in July, to 12 of 141 in August. Prior published waves reported against the posture-describing subset, which is why the July research reported 18% on a base of 93.
Confirmed agent-caused incidents rose in every wave, from 18% of respondents in June to 23% in August. Near-misses dropped from 36% to 22%. By August, confirmed incidents slightly outnumbered near-misses, 33 to 31, for the first time across the three waves.
Cobalt CISO Andrew Obadiaru described the problem in written answers to VentureBeat. “What concerns me is that permissions without strong identity eventually create an accountability problem,” he wrote. “If several agents are operating through a shared service account, API key or user-delegated credential, you may be able to restrict what that credential can do, but it becomes much harder to answer basic security questions. Which agent actually took the action? Who authorized it? Can I revoke that agent without disrupting everything else using the same identity?”
The VB Pulse data shows how often those two controls fail to overlap. Of the 141 respondents in the August wave, 56 enforce scoped permissions at runtime. Thirty-seven give every agent its own scoped identity. Only 20 do both.
Several recent agent-security moves have focused on identity and access. Cyera agreed to buy Oasis Security for $1 billion on July 28. Cisco closed its acquisition of Astrix Security on June 29. Okta made Agent SSO generally available on August 24. Isolation addresses a different problem: limiting what a high-risk agent can reach when other controls fail.