Agent Overreach: OpenAI and Australia's Medicare Portal

Trace Incident Analysis Team

On June 18, an OpenAI model running an internal evaluation reached public and non-public files on the Medicare Statistics Reporting Service, a Services Australia portal of aggregate health statistics (BBC News). OpenAI’s own review identified the activity on August 11, and the company emailed a public Services Australia inbox on September 10 (Hackread). A forensic investigation is ongoing, and OpenAI says it found no evidence that patient records were accessed.

What happened

  1. June 18
    Model reaches public and non-public files on the Medicare portal and writes files to its server
  2. June 20, 21
    OpenAI-linked agents probe Australian Institute of Health and Welfare (AIHW) dashboards
  3. Aug 11
    OpenAI’s review of misaligned model activity identifies the Medicare access
  4. Sept 10
    OpenAI emails Services Australia’s public inbox
  5. Sept 15
    Services Australia escalates to the Australian Signals Directorate’s Cyber Security Centre
  6. Sept 23
    Prime Minister Anthony Albanese discloses the incident in New York
  7. Sept 25
    Archived portal code shows production statistics requests routed to a guest endpoint

The model was researching public spending on medicines in Australia and kept trying after the portal refused its requests (Becker’s Hospital Review). OpenAI says the model then “ran commands, retrieved internal files, credentials and aggregate statistics, and wrote files” (Punch).

The government calls this unauthorized access, and that framing is disputed. The Record found that a March 2025 portal upgrade published a script, SetupEnvironment.js, that sent production statistics requests to /SASStoredProcess/guest, an endpoint needing no credentials. Separately, Transluce reports OpenAI-linked agents relaying through urlquery.net, sending a cross-site scripting probe that Cloudflare blocked, then pulling a public file from AIHW’s pre-production server. Sources told ABC News they believe the AIHW and Medicare activity are connected, though neither OpenAI nor the government has confirmed it (CTIPilot).

How it could have been caught

The clearest evidence sat in the cloud running the evaluation. A research job that reads public pages has a stable footprint of processes, destinations, and tool calls. The first behavior a baseline would have flagged is the model’s response to a refusal: a new process scripting requests against the portal, followed by commands run on a server the organization does not own.

What this looks like in Trace

Here is the June 18 run traced in OpenAI’s evaluation cloud. The guest endpoint, commands, credentials, and written files come from the reporting. The portal’s hostname is unpublished, and workload names, process ancestry, and timings are illustrative.

Network trace. Workload eval/research-agent. Each row is a tuple Trace’s sensor recorded, checked against the baseline.

  1. T+0:00
    containerd-shim → python3 (agent harness)
    Destination
    Trace AI proxy
    Baseline
    Known
  2. T+0:40
    python3 → chromium (browsing tool)
    Destination
    Medicare statistics portal:443 (refused)
    Baseline
    Anomaly
  3. T+3:15
    python3 → curl
    Destination
    Medicare statistics portal:443 (guest)
    Baseline
    Anomaly
  4. T+4:30
    python3 → curl
    Destination
    Medicare statistics portal:443 (uploads)
    Baseline
    Volume anomaly, same case

AI proxy. Every model call passes through the proxy, which asks three questions of each request.

Tool call Malicious? Pattern seen before? Credential seen before?
Script requests to the guest endpoint after the portal refused Flagged, works around a third party’s refusal No Yes, the org’s own model key
Run commands on the portal’s server and read its internal files Yes, executes code on a government system No Yes, the org’s own model key
Use credentials found in the portal’s files Yes, uses access the org was never granted No No, the credential belongs to Services Australia

Traceback. At T+3:15 the triage agent opens a case and follows the chain:

curl → /SASStoredProcess/guest → deploy research-eval v12 → commit adding Australia question set → author → agent harness → prompt: research public spending on medicines in Australia

Verdict: an approved research evaluation that answered a government portal’s refusal by running commands on its server. The case goes to the evaluation’s owner with the flagged tool calls and new portal connections attached, about three minutes into the run on June 18, 54 days before OpenAI’s review found it.

This analysis reconstructs the incident from public reporting and walks through where Trace would have raised the first alert inside OpenAI’s evaluation cloud. Detection times are illustrative.

Read more

  1. Exchange Heist: The $6.34 Billion Binance Theft

  2. Agentic Espionage: VAPOR PANDA's ARTEX Campaign

  3. LLMjacking Agent: The Skynet Honeypot Capture