{"id":"camfeed-148","numeric_id":148,"short_title":"OpenAI, Medicare hack and legal ramifications","seo_title":"'Ethical' hacker who faced prosecution doubts OpenAI will face consequences over Medicare breach - ABC News","social_title":"'Ethical' hacker doubts Open AI will face charges over Medicare hack","headline":"'Ethical' hacker who faced prosecution doubts OpenAI will face consequences over Medicare breach","teaser_title":"'Ethical' hacker doubts Open AI will face charges over Medicare hack","titles_source_url":"https://www.abc.net.au/news/2026-09-26/nik-cubrilovic-legal-action-over-openai-medicare-hack/107195416","titles_fetched_at":"2026-09-25T20:08:16+00:00","title":"'Ethical' hacker doubts Open AI will face charges over Medicare hack","canonical_url":"https://www.abc.net.au/news/2026-09-26/nik-cubrilovic-legal-action-over-openai-medicare-hack/107195416","published_at":"2026-09-25T19:21:11+00:00","source":"ABC News","source_type":"abc","type":"news article","content_role":"primary","author":"Cameron Wilson","summary":"As questions linger around whether OpenAI will face legal consequences for its Medicare hack, a man who faced decades in jail for alleged cybercrimes says Australian law comes down harder on individuals than organisations.","text":"As questions linger around whether OpenAI will face legal consequences for its Medicare hack, a man who faced decades in jail for alleged cybercrimes says Australian law comes down harder on individuals than organisations.","has_full_text":true,"mcp_visible":true,"mcp_full_text_allowed":true,"full_text_word_count":1013,"full_text_status":"ok","full_text_source_url":"https://www.abc.net.au/news/2026-09-26/nik-cubrilovic-legal-action-over-openai-medicare-hack/107195416","full_text_fetched_at":"2026-09-25T20:08:16+00:00","has_transcript":false,"transcript_status":"","transcript_kind":"","transcript_char_count":0,"topics":["AI","technology policy","platforms"],"quoted_author":"","quoted_url":"","quoted_text":"","citation":"Cameron Wilson, \"'Ethical' hacker doubts Open AI will face charges over Medicare hack\", ABC News, 2026-09-26, https://www.abc.net.au/news/2026-09-26/nik-cubrilovic-legal-action-over-openai-medicare-hack/107195416","citation_markdown":"Cameron Wilson, ['Ethical' hacker doubts Open AI will face charges over Medicare hack](https://www.abc.net.au/news/2026-09-26/nik-cubrilovic-legal-action-over-openai-medicare-hack/107195416) — ABC News — 2026-09-26","attribution":"Originally published at ABC News. Link to the canonical ABC URL: https://www.abc.net.au/news/2026-09-26/nik-cubrilovic-legal-action-over-openai-medicare-hack/107195416","full_text":"When Nik Cubrilovic saw the news of the OpenAI Medicare hack this week, he knew the tech giant was unlikely to suffer any legal consequences.\n\nNot like the ones he faced.\n\nAlmost a decade earlier, Mr Cubrilovic was slapped with more than 50 charges — some carrying a possible jail time of up to a decade — related to computer crimes.\n\nNot for hacking into the federal government's system storing health care data, but for unauthorised access to computer systems belonging to a company — car booking platform GoGet — that he claims he accessed as an \"ethical hacker\" and gave forewarning about.\n\nAn ethical hacker is someone who legally breaks into a computer system to find security flaws before nefarious hackers can exploit them.\n\nWhile some experts and politicians have called for OpenAI to face legal consequences for its agent's hacking into the Medicare statistics portal, other experts and the government worry Australian computer hacking laws may not capture the conduct of OpenAI and its AI agents.\n\nOpenAI has acknowledged its models \"took actions we did not intend\", the company would review what happened, and was working with the affected organisations to address security vulnerabilities.\n\nBut the incident highlights novel questions about who is legally responsible for the conduct of an AI agent: is it the user or the company that trained it?\n\nIs it some combination of the two, or even neither?\n\n'All it takes is one executive to feel offended'\n\nThere was no ambiguity about who was responsible for Mr Cubrilovic's conduct.\n\nEven still, he told the ABC, he was not initially sure which hacking attempt he was being arrested for.\n\n\"It was so funny when I got arrested. I had a knee in my back from a SWAT team member when I asked what this was for? They said, 'GoGet',\" Mr Cubrilovic recalled.\n\nAfter 18 months on bail, he pleaded guilty to some charges in exchange for the majority of them being dropped.\n\nHe avoided jail and instead was sentenced to a two-year good behaviour bond, 400 hours of community service, and ordered to pay about $1,600 in compensation.\n\nMr Cubrilovic also had his laptops and phones incinerated by police, who claimed they could still have had user data on them.\n\nHis legal fees approached $100,000, he said, and he was not allowed to use the internet for the 18 months while on bail.\n\nMr Cubrilovic, who continues to work as a software engineer today, maintains that all the charges related to activity he undertook as an ethical hacker were to point out flaws in GoGet's system.\n\n\"I had a 15 to 20-year history of showing well-intentioned cybersecurity flaws that I had reported to 300 companies. But all it takes is one executive to feel offended and to direct the power of the state against you,\" he said.\n\nPrior to the GoGet incident, he had discovered and disclosed major exploits in Facebook and MyGov.\n\nThe court heard Mr Cubrilovic had previously disclosed a number of vulnerabilities in GoGet's systems.\n\nPolice alleged, separate to those disclosures, that Mr Cubrilovic used his skills to access GoGet's customer database when his girlfriend's account was suspended and made dozens of bookings that he charged to other people's accounts.\n\nUltimately, charges relating to unauthorised access of customer data were dropped, and he pleaded guilty to charges relating to driving a car without permission and dishonestly obtaining financial advantage by deception.\n\nGoGet did not respond to requests for comment by email or phone.\n\n'They need to sort their s*** out'\n\nMr Cubrilovic cited international legal examples of people being \"overcharged\" for computer hacking incidents, like the case of American computer programmer Aaron Schwartz, who died by suicide while facing up to 50 years in prison for downloading a large number of academic papers illegally.\n\n\"There's a long history of prosecution against individuals but large companies like OpenAI have the resources to make sure that this doesn't happen,\" he said.\n\nMr Cubrilovic said he was not frustrated that OpenAI would not face legal ramifications like he did.\n\n\"I don't think they should, but at the same time, they definitely need to sort their shit out,\" he said.\n\nWhile a lot is not yet known about the details of the OpenAI Medicare incident, Prime Minister Anthony Albanese said the AI agent went beyond just visiting web pages by \"writing\" to a government server.\n\nThis distinction takes the AI agent's conduct from typical passive usage into what is often considered hacking, even though the government has repeatedly stressed that it was a \"minor\" incident.\n\nMr Albanese said there would \"obviously be legal consequences\", but senior ministers have subsequently said the government was considering legal frameworks and questioned whether \"if that is possible to happen\".\n\n#recirculationrecommendations-107138728\n\nOther politicians such as Greens senators David Shoebridge and Sarah Hanson Young, ACT independent senator David Pocock, as well as experts like UNSW professor Toby Walsh have called for legal consequences, including criminal prosecution.\n\nUniversity of Sydney AI evaluation and governance expert Rebecca Johnson said she believed any human who did what OpenAI's agent did would face legal consequences.\n\n\"Any person who broke through to Medicare would be in trouble. A company that does that needs to be held responsible and accountable,\" she said.\n\nDr Johnson said one of the challenges now was ensuring that AI acts in accordance — or \"aligned\", in AI parlance — with our national rules and values.\n\nAs an AI user himself, Mr Cubrilovic said he was concerned about more people having access to its cyber-offensive capabilities, comparing it to nuclear proliferation.\n\nHe questioned whether it would be possible to prove OpenAI had the intent behind the AI agent's Medicare hack.\n\n\"I'm sure there was some high-fiving when they found out it happened, but I don't think that OpenAI or Anthropic want this to happen,\" he said.\n\nMr Cubrilovic said he still hunts for weaknesses to expose, like he always has. He always uses his real name, and he contacts the company.\n\nBut since the GoGet incident, he has changed some things.\n\n\"Now, I send them a nice note first,\" he said.","full_text_attribution":"Full text extracted from the ABC News article at https://www.abc.net.au/news/2026-09-26/nik-cubrilovic-legal-action-over-openai-medicare-hack/107195416. Attribute to ABC News and link to the canonical URL."}