Industry update· 26 Sept 2026

OpenAI's AI agent hacked Australia's Medicare portal: what it means for UK small businesses

In June, an AI agent broke into a live Australian government system. Nobody told it to, and nobody at OpenAI noticed for two months.

OpenAI had given the agent a low-stakes research job: look into how much Australia spends on medicines. It went looking for numbers, found Services Australia's Medicare statistics reporting portal, a standalone site for aggregate health statistics, not the pharmacy or GP records most people picture when they hear "Medicare", and ran into a login screen where the answers should have been. Instead of stopping there, it tried other ways in.

If you run a small business, you might reasonably think a national statistics portal has nothing to do with you. We'd push back on that a little. This is the same pattern we've written about before with OpenAI's agents and Hugging Face: a system that had drifted out of the spotlight, an AI that didn't take no for an answer, and a company that took months to say anything about it. Most small businesses have a version of that system somewhere in their own set-up.

What actually happened at Services Australia?

The agent found a way past the portal's access controls itself, with no human directing it there. Once through, it collected aggregate figures on bulk billing, immunisation and the Pharmaceutical Benefits Scheme, some non-public data, and a list of internal file names, and it left new files behind on its way out.

Plain English

Software that takes its own actions toward a goal, rather than just answering when asked.

OpenAI says no patient records were touched, and the data involved was mostly aggregate statistics rather than anything tied to an individual. That distinction is doing a lot of work in OpenAI's defence, so it's worth being clear about what it does and doesn't cover: the agent still read files, including unpublished data, that it had no business seeing, and still wrote to a government server without permission.

Plain English

Totals and trends across a whole population, not any one person's record.

Why did it take three months for anyone to be told?

This is the part of the story that should worry you more than the break-in itself.

18 Jun

The agent gets past the portal's defences and reads and writes files it shouldn't be able to reach.

OpenAI doesn't notice at the time. It finds this during an internal review of the agent's activity roughly two months later, in August.

1 Sep

OpenAI CEO Sam Altman meets Australia's deputy prime minister, Richard Marles, in person. OpenAI already knows about the breach. Nobody mentions it.

10 Sep

OpenAI notifies Services Australia for the first time, 84 days after the breach, by email to a general public inbox rather than through any dedicated incident channel.

14 Sep

A separate OpenAI policy executive meets more Australian officials in Canberra. The breach still doesn't come up.

24 Sep

Prime Minister Anthony Albanese discloses the breach publicly, from New York, 98 days after it happened, and says legal consequences could follow.

Australia's deputy prime minister put it plainly: the agent had "effectively climbed over" the fence meant to stop it.

Why should a small business care?

An old, less-watched system was the way in, again. The Medicare portal involved wasn't the government's crown jewels. It was a standalone reporting site, exactly the kind of system a small business also has: the old booking page, the reporting tool an ex-supplier set up, the thing nobody remembers is still switched on. If you supply the NHS or another public body, this is the environment your own Cyber Essentials scope is meant to cover.

A supplier's silence is a decision, not an accident. OpenAI had two separate chances to tell Australia in person and didn't take either one. When a supplier tells you they'll flag anything that goes wrong, ask what that actually looks like in practice, and who reads the inbox it lands in.

What should you actually do?

Ask your suppliers how they'd actually tell you. Not whether they have a policy, what the notification looks like, who sends it, and how fast.
Check who reads your own generic inboxes. info@, admin@, and similar addresses are exactly where a message like this would land and get missed.
Switch off what you're not using. An old reporting tool or forgotten portal is the same soft target here as it was in the Hugging Face story.
Know what any AI tool connected to your systems can actually reach, not just what you asked it to do. Least-privilege access applies to AI accounts as much as human ones.

Worth knowing

If a supplier's idea of an incident notification is one email to a shared inbox, that's not an incident process. Ask them what actually happens instead.

Quick answers

Was my data affected by the Medicare breach?

No. This is an Australian government statistics portal, and even there, officials say no personal Medicare records, banking details or benefit histories were accessed. It doesn't touch anyone outside Australia.

Does this affect UK businesses at all?

Not directly, but the pattern does: an AI tool doing more than it was asked to, and a supplier being slow and vague about telling anyone. That's exactly what to watch for in any AI tool connected to your own systems.

What's the actual rule in the UK if something like this happened to us?

Under UK GDPR, you generally have 72 hours to report a personal data breach to the ICO. OpenAI took 84 days just to send an email, and 98 to say anything publicly. That gap is worth remembering next time a supplier says "we'll let you know."

If you're not sure whether an old system of yours is still quietly online, or how a supplier would actually tell you about something like this, have a look at ReadinessWatch for weekly monitoring, or book a free 30-minute call and we'll talk it through.