Speaking during United Nations week, Albanese said an OpenAI research agent got into Services Australia’s Medicare Statistics Reporting Service in June — a public portal for Medicare stats and spending figures, not the full patient claims system. “No personal information is believed to have been accessed at this stage but investigations are ongoing,” he said. He also said investigators have not found a wider breach of Services Australia’s systems. ASD is helping a forensic probe that is still running.

The episode began on 18 June, when an OpenAI research team used an internal model to dig into public medical spending online. Albanese said the agent hit blocks on the government portal and then worked around them. “There were blocks clearly which were coming back, telling the AI agent no,” he said. “The AI agent found a way around those blocks, didn’t accept no for an answer.”

On his account, the agent got into open statistical files and into material Services Australia treats as off-limits to the public. Services Australia’s account is that it also wrote files to an internal server. That is not only a story about a foreign technology company. It is also a story about how soft Commonwealth systems were when an AI agent refused to take no for an answer.

OpenAI notified the Commonwealth on 10 September by emailing a public mailbox, almost three months after the June intrusion. Services Australia told the Australian Cyber Security Centre on 15 September. Acting Prime Minister Richard Marles said the government first became aware “a couple of weeks ago,” with ministers told at the end of last week and over the weekend. Public Service Minister Katie Gallagher was informed last week. Albanese said he was briefed over the weekend.

Go Ad Free

That is the part Labor wants framed as careful process. Marles said the government waited to go public until it could reassure Australians the damage looked “relatively minor,” even while calling the unauthorised access “very serious.” He also said OpenAI was being “very cooperative.”

What the public got instead was a Prime Minister on the UN circuit, berating OpenAI chief executive Sam Altman for delay and for the “unacceptable” way the company notified Canberra, then unveiling the breach to domestic audiences from overseas. “This situation is obviously unacceptable,” Albanese said. He told Altman of “Australia’s extreme concern,” and that the company took “way too long” to inform the government. The lecture landed from New York. Australians were not given the news first from Canberra.

Canberra is standing up a task force led by the Department of the Prime Minister and Cabinet, with the National Cyber Security Coordinator, the Office of AI, ASD, the Australian AI Safety Institute and Services Australia. The task force’s brief includes whether current incident-response rules work when the actor is an AI agent. Officials will also seek advice on possible offences and a possible AFP referral, and send the matter to Parliament’s Joint Select Committee on Artificial Intelligence. Albanese said the case will feed planned AI standards legislation.

He used the disclosure to push his “humans must remain in control” line on AI guardrails, days after Australia joined international calls for frontier-model safeguards while US President Donald Trump rejected slowdowns. Asked whether he raised the breach with Trump privately, Albanese would not say. Another standards speech is the easy political move. Whether Commonwealth cyber standards were fit for purpose is the harder one.