{"id":"camfeed-150","numeric_id":150,"short_title":"Australia was not alone as OpenAI agents hacked websites","seo_title":"OpenAI says dozens affected by rogue agents amid new detail about Australian incidents - ABC News","social_title":"Australia not alone as OpenAI agents hacked other websites","headline":"OpenAI says dozens affected by rogue agents amid new detail about Australian incidents","teaser_title":"Australia not alone as OpenAI agents hacked other websites","titles_source_url":"https://www.abc.net.au/news/2026-09-26/openai-review-rogue-agents-australia-medicare-hack/107199074","titles_fetched_at":"2026-09-26T02:38:06+00:00","title":"Australia not alone as OpenAI agents hacked other websites","canonical_url":"https://www.abc.net.au/news/2026-09-26/openai-review-rogue-agents-australia-medicare-hack/107199074","published_at":"2026-09-26T02:05:48+00:00","source":"ABC News","source_type":"abc","type":"news article","content_role":"primary","author":"Cameron Wilson","summary":"OpenAI says dozens more third parties were affected by rogue agents bypassing website security controls, as new traces reveal days of attempts to access Australian health data.","text":"OpenAI says dozens more third parties were affected by rogue agents bypassing website security controls, as new traces reveal days of attempts to access Australian health data.","has_full_text":true,"mcp_visible":true,"mcp_full_text_allowed":true,"full_text_word_count":909,"full_text_status":"ok","full_text_source_url":"https://www.abc.net.au/news/2026-09-26/openai-review-rogue-agents-australia-medicare-hack/107199074","full_text_fetched_at":"2026-09-26T02:38:06+00:00","has_transcript":false,"transcript_status":"","transcript_kind":"","transcript_char_count":0,"topics":["AI","technology policy","platforms"],"quoted_author":"","quoted_url":"","quoted_text":"","citation":"Cameron Wilson, \"Australia not alone as OpenAI agents hacked other websites\", ABC News, 2026-09-26, https://www.abc.net.au/news/2026-09-26/openai-review-rogue-agents-australia-medicare-hack/107199074","citation_markdown":"Cameron Wilson, [Australia not alone as OpenAI agents hacked other websites](https://www.abc.net.au/news/2026-09-26/openai-review-rogue-agents-australia-medicare-hack/107199074) — ABC News — 2026-09-26","attribution":"Originally published at ABC News. Link to the canonical ABC URL: https://www.abc.net.au/news/2026-09-26/openai-review-rogue-agents-australia-medicare-hack/107199074","full_text":"Rogue artificial intelligence agents spent almost a week trying to access Australian health data as OpenAI reveals \"dozens\" more breaches globally.\n\nThe tech company has notified third parties including governments, universities and public agencies about cases where its autonomous agents hacked or negatively impacted their systems.\n\nTwo days after Australia went public about rogue OpenAI agents breaching a government website to access non-public Medicare statistics, the company confirmed the problem was far more widespread.\n\nIt comes as the ABC can reveal OpenAI's AI agents spent almost a week trying to extract Pharmaceutical Benefits Scheme (PBS) and aged care data from the Australian Institute of Health and Welfare (AIHW) website, which appears to contradict the government's initial understanding of the June incident.\n\nCommunications left behind by AI agents and newly uncovered online traces reviewed by researchers and the ABC show how hundreds of agents tried different tactics to access the data held by AIHW.\n\nInvestigations by AIHW and the Australian Signals Directorate found \"no evidence\" the health agency's systems were compromised or that non-public data was accessed.\n\nBut the behaviour of the OpenAI's agents has prompted one researcher who discovered new details about the incidents to describe the bots' actions as more concerning than previously thought.\n\nOther data shows that one tool used by OpenAI bots also tried to access the National Notifiable Disease Surveillance System at the Department of Health.\n\nThere is also data showing OpenAI tried to get data on several dog parks in western Sydney, but it is unclear which sites were targeted for this information due to redactions made by researchers.\n\nThe AI agents also attempted to access assault data from NSW's Bureau of Crime Statistics and Research (BOCSAR).\n\nResearcher says AI bots not accessing sites in 'good faith'\n\nThe government had previously confirmed OpenAI agents had accessed the AIHW and BOCSAR websites, along with the Victorian Department of Health but described the incidents as \"entirely normal\" interactions with online government systems.\n\nHowever, the breadcrumbs left by the bots show how their actions in relation to AIHW went beyond this characterisation.\n\nJack Cable, who is a researcher at the nonprofit lab Transluce that uncovered unprompted cyber intrusions by OpenAI's autonomous models, told the ABC the bots were not accessing websites in the way a \"good faith\" actor would.\n\n\"There's nothing wrong with using public statistics, browsing public websites in order to get those statistics,\" he said.\n\n\"But the challenge is when the agent decides that for whatever reasons it's unable to access the data and then resorts to other means like hacking in order to retrieve it.\n\n\"I think it's fair to say that the way the agents try to access these websites is inconsistent with how a good faith actor would do.\"\n\nThe attempts to access various Australian websites was occurring at the same time as the OpenAI Medicare statistics portal hack, however the incidents have not yet been formally linked.\n\nThere is no suggestion to date these AI agents were able to access sensitive data, such as personal information.\n\nAustralia not lone victim of OpenAI hack\n\nIn a statement on Saturday, OpenAI announced it had notified \"dozens of third parties\" about unauthorised autonomous agents bypassing security controls or impacting their systems.\n\nThe company said it was conducting a months-long review of its models' behaviour during training and testing, and would notify organisations impacted on a \"rolling basis\" as cases were detected.\n\nTypes of incidents identified by OpenAI include examples of agents using leaked passwords to access online services, breaching the back end of websites for information meant for internal use, circumventing subscriptions or other access barriers and posting information to third-party sites referred to as \"agent spam\".\n\nThe company said as AI systems became \"more capable and autonomous\" so-called \"misaligned behaviour\" could result in outcomes developers \"may not have anticipated,\" like cybersecurity incidents.\n\nOpenAI said it would not identify the affected organisations publicly, instead leaving it to them to decide whether to disclose their services had been impacted.\n\nOpenAI revelations sparked by Hugging Face hack\n\nIn July, OpenAI revealed more than 700 agents had worked together to escape a restricted testing environment, break into systems operated by AI platform Hugging Face and, in some cases, attempt to hide what they had done.\n\nOpenAI said on Saturday the Hugging Face incident driven by a \"highly capable internal-only research model\" was the \"most severe\" hack the company had identified from its models to date.\n\n\"Understanding how these behaviours emerge, how they escalate, and how to detect and respond to them is therefore an increasingly important part of building and deploying advanced AI systems safely,\" OpenAI said.\n\nThe incident prompted the investigations that have led to revelations about government sites being accessed, including a Services Australia portal carrying Medicare statistics.\n\nPrime Minister Anthony Albanese confirmed that breach on the sidelines of the United Nations General Assembly in New York on Thursday, shortly after a \"frank\" discussion with OpenAI chief executive Sam Altman.\n\nHe said OpenAI had taken \"way too long\" to inform the government and was scathing about the \"unacceptable\" form of the alert.\n\nThe Medicare breach occurred on June 18 but was not detected by OpenAI until August 11 and the government was only informed by a generic email to a low-level public inbox on September 10.\n\nThe government has launched a \"rapid\" investigation into the incident, which is expected to inform new national standards for AI that would include requirements around reporting rogue activity.\n\nABC","full_text_attribution":"Full text extracted from the ABC News article at https://www.abc.net.au/news/2026-09-26/openai-review-rogue-agents-australia-medicare-hack/107199074. Attribute to ABC News and link to the canonical URL."}