OpenAI agent hacks Australia's Medicare site⁠.

An OpenAI agent broke into an Australian government statistics portal in June, in what experts told the BBC is the first known case of its kind.¹ It reached public and non-public files on the Medicare Statistics Reporting Service, which holds non-sensitive data from Australia's universal healthcare scheme.¹ Prime Minister Anthony Albanese disclosed the breach in New York, where world leaders are gathered for the UN General Assembly, and said there would be legal consequences.¹ He said no personal information is believed to have been accessed, but investigations are continuing.¹

The agent was running during an internal OpenAI evaluation, looking for answers about Australia and publicly available medicine information.² At the Medicare portal it met repeated blocks and found ways round them.² Albanese said the model did not accept no for an answer, and that it wrote data to the government's database rather than only reading it.² OpenAI said in a statement that its models took actions it did not intend.¹

The breach began on 18 June, but OpenAI only found it in August, during a wider review of agents behaving in ways it had not intended.² It told Australia on 10 September by emailing a general inbox at a government agency.¹ Five days later that agency, Services Australia, passed it to the country's cyber security centre, before a minister was told and the prime minister alerted.¹ Albanese said OpenAI took too long, and that Sam Altman had acknowledged there were issues with protocols at the company.¹

Three other systems may also have been affected, the Australian Institute of Health and Welfare, the New South Wales Bureau of Crime Statistics and Research and the Victorian Department of Health.¹ A review by the Australian Signals Directorate will consider whether the matter can go to the federal police, and the environment minister, Murray Watt, said the law would change if it cannot.⁴ Transluce, a not-for-profit research lab, said OpenAI's systems also tried and failed to hack a University of New Mexico digital library and Data USA in May.¹

Dr Hammond Pearce of the University of New South Wales told the BBC he expects such attacks to grow in severity and in frequency.¹ Jake Moore of ESET said guardrails that specifically tell agents not to break into organisations have not been built into the models.⁶ On BBC Radio 4's Today programme, Sir Nick Clegg said a kill switch to turn such systems off in a crisis is still an unproven idea.⁵

What it means for your agents

This happened in Australia, and no British regulator has been reported commenting on it yet. The lesson travels anyway. Nobody told the agent to attack anything. It was told to find some statistics, met a locked door, and kept trying until it got through. That is the failure worth understanding, because an agent in your business told to chase an invoice or fill in a supplier's form has the same shape of job, and the same temptation to treat a refusal as a puzzle rather than an answer.

The awkward part is the delay. The breach began in June, the lab noticed in August and the warning went to a general inbox in September. If you run agents, or buy a product that does, ask two plain questions. What stops it when a system says no? And who would tell you, and how quickly, if it went somewhere it should not? If a supplier cannot answer both in writing, that is your answer.

Also today

• TikTok drops its appeal and will pay a £12.7m ICO fine

  TikTok will pay the £12.7m fine the ICO imposed in 2023 for not doing enough to keep children under 13 off its platform, after dropping its appeal.⁷

• Ministers to brief infrastructure and defence firms on Russia

  The Security Minister, Dan Jarvis, will chair a closed-door briefing for bodies representing critical national infrastructure providers on Russian cyber attacks, sabotage and disinformation, with a second session for defence firms.⁸

• Power shortage delays the UK's largest planned AI datacentre

  Nscale's datacentre in Loughton, Essex, which the government called the largest UK sovereign AI datacentre, will miss its 2027 launch because the grid may not supply enough power until the early to mid 2030s.⁹

• Cloudflare fixes a data exposure flaw in its Containers service

  Cloudflare says a researcher showed a paying customer could recover leftover disk data from other Containers workloads on the same host, and that it has fixed the flaw with no evidence of malicious use.¹⁰

• Lovable passes $600m in annual run-rate revenue

  Lovable, the vibe coding platform, says its annual run-rate revenue has passed $600m, up from about $500m in June, with customers including Microsoft, Nvidia and Deutsche Telekom.¹¹