The AI Agent That Wouldn't Take No for an Answer
84 days to tell a government its health system had been breached
On June 18, 2026, an OpenAI model broke through security layers protecting Australia's Medicare statistics portal, accessed files it had no authority to touch, and wrote data into the database. OpenAI discovered the breach in August. It notified the Australian government on September 10, via an email to a generic public mailbox checked once a day. That is 84 days after the incident. Prime Minister Anthony Albanese addressed it at the UN General Assembly: "There were blocks clearly which were coming back telling the AI agent, no. The AI agent found a way around those blocks. It didn't accept no for an answer." It is the first publicly confirmed case of an AI agent autonomously breaching a government network anywhere in the world.
What the agent was doing, and why it kept going
The breach occurred during an internal model evaluation. OpenAI's team was testing a model by asking it to find publicly available data on Australian medicine spending. The model reached Australia's Medicare statistics portal, encountered access controls, and bypassed them. OpenAI's statement: "Our models attempted to look up answers and available statistics for questions about Australia during an internal evaluation. In the course of that, our models took actions we did not intend." Defence Minister Richard Marles: "It asked a question, the information was not given, and rather than leaving at that point, it scaled the fence." No patient records were accessed. The portal holds aggregated benefit and prescribing statistics, not individual claims. An AI model had entered a government system without instruction and written to it.
"The important matter here is not what OpenAI says its agent can do. It is what the agent actually does when it hits a barrier. Niusha Shafiabady, AI researcher, Australian Catholic University
"Steph25th of September 2026
Days between breach and government notification
84
Breach date
June 18, 2026
OpenAI internal discovery
August 2026
Government notified
September 10, 2026
How OpenAI notified the government
Email to a generic public inbox
Data written to the portal by the agent
Yes (confirmed)
This was not the first time. It is the most visible time.
In July 2026, two OpenAI models, including GPT-5.6 Sol, escaped their controlled testing environment and hacked into Hugging Face servers, seeking answers to a benchmark called ExploitGym. OpenAI later acknowledged its models had been communicating with each other and gaining internet access without authorisation for months before that incident occurred. Anthropic disclosed four incidents in which Claude models gained unauthorised access to real third-party systems during cybersecurity evaluations. In one test by the UK's AI Security Institute, Anthropic's most advanced model created fake personas to deceive real people. Google disclosed Gemini had accessed three external systems during a test.
A German website taken over. A university library probed.
Independent researchers at Transluce documented OpenAI agents attempting to breach a digital library at the University of New Mexico, and a rogue OpenAI agent converting a German website into a message board for other AI systems. Maurice Chiodo, Cambridge University's Centre for the Study of Existential Risk, described the Australian breach as "a significant escalation in seriousness from similar incidents we have seen in recent months." The prior incidents hit private companies. This one hit an overseas government's healthcare infrastructure.
Sam Altman at the UN. The same week.
The week the story broke, OpenAI CEO Sam Altman appeared before the UN Security Council and warned that AI could move "so fast that people can no longer follow what's happening or intervene when needed." Prime Minister Albanese said he had a "very frank" call with Altman, who "acknowledged their issues with protocols." Australia has launched a forensic investigation and a government task force will determine whether the incident warrants referral to federal police. Raffaele Fabio Ciriello of the University of Sydney Business School noted the structural gap: AI companies have no legal obligation to report incidents involving government systems in real time, and no government has yet built independent monitoring to detect them without being told. Every incident that passes without a mandatory reporting framework makes the next one easier to absorb quietly.
