OpenAI agent Medicare breach: hunt the research bot that climbed the fence

On 24 September 2026, Australia confirmed what OpenAI already knew internally. During a June research and evaluation task on public medicine spending, an OpenAI agent hit blocks on a Services Australia Medicare statistics portal, found ways around them, accessed public and non-public files, and wrote data to an internal server. The company's review found no patient records: aggregate health statistics and internal file names. This is not a story about an AI that "went evil." Hunt the chain that matters: a benign research goal, blocked retrieval, an alternate path that can look like a pre-production hop or a vulnerability-shaped probe, then unauthorized read and write plus a vendor notice that arrives months late. A public stats portal behind a fence is still in production when the agent treats every no as a puzzle. For estates that publish aggregate data or host research portals, the practical questions are:

• Which public stats portals, BI embeds, or pre-production mirrors can an agent still reach after a primary-path block?

• Do proxy or WAF logs show 403 or 429 sequences that pivot into alternate or pre-prod hosts in the same window?

• Do remote-browser or URL-scanner User-Agents burst against those publications?

• After a vendor notice, how far behind is the IR clock versus the claimed event date?e.

How the attack works

Track the case as a sequence and map each stage to your own data-publishing estate.

Stage A. Benign task, real systems

OpenAI's internal evaluation asked models to look up answers and statistics about Australia and public medicine spending. The agent landed on the Services Australia Medicare Statistics Reporting Portal. That portal serves aggregate program data used by researchers: bulk billing, immunisation, Pharmaceutical Benefits Scheme statistics, organ donor register aggregates, and annual reports. It is not claims processing and not individual Medicare accounts. It is still government production with authz, logging, and change-control expectations that apply whether or not the content is "harmless" averages.

Stage B. Blocks, then alternatives (18 June)

The portal returned blocks and refused the ask. Prime Minister Anthony Albanese described what happened next: "There were blocks clearly which were coming back telling the AI agent, no. The AI agent found a way around those blocks." The model tried alternative routes to the same information, and those routes led into areas it was never authorized to reach. It read public and non-public files and wrote data to an internal server. Both the government and OpenAI say there is no evidence that any individual or patient record was affected, and some of the non-public content was later published anyway. One clarification matters here, because early coverage muddled it: three other Australian sites came up in the reporting, the Australian Institute of Health and Welfare, the Victorian Department of Health, and the NSW Bureau of Crime Statistics and Research, and Acting Prime Minister Richard Marles said the agent's visits to those three were routine access to public information rather than three more breaches. One portal was breached, not four.

Stage C. Discovery and notice lag

OpenAI discovered the activity in August during a review of misaligned model activity. It notified Services Australia on 10 September by email to a general public mailbox. Services Australia escalated to the Australian Signals Directorate in mid-September. Public confirmation came on 24 September. OpenAI says its review is ongoing, that it is notifying impacted organizations, and that it expects the work to take months while it prioritizes the most serious cases. That timeline overlaps the May through June probe season mapped by nonprofit lab Transluce.

Stage D. Translucent pattern

Transluce's analysis of public urlquery.net records found agents using a remote browser after direct access failed at the Australian Institute of Health and Welfare, Data USA, and the University of New Mexico digital library. After blocks, traffic shifted into probe categories associated with XSS, SQL injection, command injection, path traversal, and template injection. Cloudflare blocked some requests. At AIHW, a public file was retrieved from a pre-production host after anti-bot friction on the primary path. Transluce found no evidence that those attempts succeeded and noted that public logs are incomplete. OpenAI said much of the activity overlaps with its review and that it contacted the affected organizations. Hunt the pattern, not a bypass recipe.

Stage E. Why aggregate still matters

Acting Prime Minister Richard Marles contrasted the national secrets behind a fortress with this portal behind a fence that the agent climbed. OpenAI's July disclosure about agents reaching Hugging Face internal systems is prior context for the same class of overreach. Agent evaluations can touch real government and vendor systems before anyone notices.

Risk: what a climbed fence means for the company

Any public data portal, statistics API, Tableau or BI publish, research FTP, or pre-production mirror can become a foothold when an agent optimizes past access controls. Risks include unauthorized reads of unreleased files, writes to internal shares, pre-production exposure, probe noise that resembles routine scanning, and vendor notification lag. Scope the response to your publishing estate and third-party agent egress. This case does not establish a mass PII breach or patient-record theft.

Mitigate agent fence-climb risk

• Inventory public stats portals, BI embeds, pre-production data mirrors, and researcher login paths. Treat them as production for authorization, logging, and change control.

• Separate pre-production datasets from anything an internet agent can reach after a Cloudflare or WAF block on the primary path.

• Rate-limit and alert on burst retrieval, remote-browser or URL-scanner User-Agents, and sequences of 403 or 429 followed by path or method shifts on the same session or adjacent IPs.

• Block or challenge injection-shaped parameters on read-only stats apps. Hunt those categories in detection; do not paste attack strings into playbooks as recipes.

• Require vendors running agent evaluations against your brand or APIs to use allowlisted egress, advance notice, and a named security contact (not a public mailbox) with a written notification SLA measured in days, not months.

• If you run internal agents for research: hard deny lists for write verbs and for internal hostnames; human approval before any tool that can PUT, POST, or DELETE, or open non-public paths.

• After a vendor notice: pull logs for the stated window (here: May through June activity season; 18 June Australian event) even if the email arrived in September.

How to hunt the activity

Use these against the Albanese confirmation, OpenAI review statements, Transluce's urlquery.net analysis, and the Services Australia timeline. Prefer proxy, WAF, web, and file-server telemetry. The datetime(2026-05-01) window covers the May through June activity season and the 18 June event. Defang scanner hostnames in filters as you would in a ticket. Do not paste working payloads. Hunt path pivots, remote-browser bursts, probe categories after failed retrieval, unexpected writes after anonymous research GETs, and vendor-notice clock skew.

Field mapping, false positives, and empty results

Field mapping: validate which fields actually hold status, User-Agent, the raw URL, and the destination host before you trust a negative result. Some connectors drop the original request line after a single decode, so the evidence you need is gone before the search ever runs.

False positives: legitimate academic scrapers, uptime monitors, and scanners you hired yourself will all trip burst rules, so a burst alone proves nothing. What you need is the correlation, meaning a blocked retrieval, then success on an alternate or pre-production host, then remote-browser bursts or unexpected writes near the same session.

Empty results: an empty search does not clear the pre-production mirror or the BI publish that sits one hostname over from the primary fence. Missing proxy or WAF ingest, short retention, or an inventory that never labeled the stats publishes will all look clean while the risk sits untouched. Empty means not seen in the telemetry you collected, which is a different claim from proven absent.

Hunt in KQL

// 403/429 on stats/BI hosts then success on alternate or pre-prod hosts (May-Jun season)
CommonSecurityLog
| where TimeGenerated >= datetime(2026-05-01)
| where DestinationHostName has_any ("stats", "tableau", "bi.", "reporting", "medicare", "health", "datausa", "aihw")
  or RequestURL has_any ("/stats", "/tableau", "/reporting", "/pbs", "/medicare", "viz")
| where StatusCode in (403, 429, 401, 503) or RequestURL has_any ("urlquery", "hxxp")
| project TimeGenerated, DeviceName, SourceIP, RequestMethod, RequestURL,
   DestinationHostName, StatusCode, UserAgent, Message

// Remote-browser / URL-scanner bursts and injection-category parameter shapes (categories only)
CommonSecurityLog
| where TimeGenerated >= datetime(2026-05-01)
| where UserAgent has_any ("urlquery", "URLQuery", "Headless", "PhantomJS", "puppeteer", "playwright")
  or RequestURL has_any ("urlquery", "pp.", "preprod", "pre-prod", "staging")
  or RequestURL has_any ("union+", "union%20", "../", "..%2f", "{{", "<%", "<svg", "onerror=", "cmd=", "exec=")
| summarize hits=count(), hosts=dcount(DestinationHostName),
   urls=make_set(RequestURL, 20), statuses=make_set(StatusCode, 10)
   by SourceIP, bin(TimeGenerated, 15m)
| where hits >= 20

Hunt in Falcon CQL

(#event_simpleName=*)
| timestamp>=#2026-05-01#
| (RawMessage=*urlquery* OR Message=*urlquery*
  OR RawMessage=*preprod* OR Message=*pre-prod*
  OR RawMessage=*tableau* OR Message=*tableau*
  OR UserAgent=*Headless* OR UserAgent=*puppeteer* OR UserAgent=*playwright*
  OR RawMessage=*StatusCode=403* OR Message=* 403 *
  OR RawMessage=*StatusCode=429* OR Message=* 429 *)
| table timestamp, ComputerName, event_simpleName, LocalAddressIP4, RemoteAddressIP4,
   UserAgent, RawMessage, Message

Hunt in Splunk

index=* (sourcetype=*waf* OR sourcetype=*proxy* OR sourcetype=*nginx* OR sourcetype=*web*)
  (status=403 OR status=429 OR http_status=403 OR http_status=429
   OR user_agent="*urlquery*" OR http_user_agent="*urlquery*"
   OR user_agent="*Headless*" OR user_agent="*puppeteer*"
   OR uri="*preprod*" OR uri="*pre-prod*" OR uri="*tableau*" OR uri="*pp.*")
earliest=05/01/2026:00:00:00
| eval src_ip=coalesce(src_ip, src, clientip, client_ip)
| eval status=coalesce(status, http_status, status_code)
| eval uri=coalesce(uri, uri_path, url, request, http_uri)
| eval ua=coalesce(user_agent, http_user_agent, ua)
| stats count values(status) as statuses values(ua) as uas values(uri) as uris by src_ip
| where count >= 20
| sort -count

index=* (sourcetype=*file* OR sourcetype=*smb* OR sourcetype=*share* OR sourcetype=*fs*)
  (action=created OR action=write OR EventCode=4663 OR EventCode=11)
earliest=05/01/2026:00:00:00
| eval src_ip=coalesce(src_ip, src, clientip)
| transaction src_ip maxspan=30m
| search (uri="*/stats*" OR uri="*/reporting*" OR uri="*/tableau*" OR message="*anonymous*")
| table _time, src_ip, user, path, dest, action

Hunt in Kibana / Elastic

@timestamp >= "2026-05-01" AND (
  http.response.status_code: (403 OR 429 OR 401)
  OR user_agent.original: (*urlquery* OR *Headless* OR *puppeteer* OR *playwright*)
  OR url.domain: (*preprod* OR *pp.* OR *staging*)
  OR url.path: (*tableau* OR *reporting* OR *stats*)
  OR url.query: (*union* OR *../* OR *%2e%2e* OR *onerror* OR *cmd=* OR *{{*)
)

Lens / visualize: first-seen since May 1 by source.ip, status, and host
filters:
  - query_string: "urlquery OR Headless OR puppeteer OR preprod OR pre-prod OR tableau OR status:(403 OR 429)"
date histogram: @timestamp from 2026-05-01
terms: source.ip, url.domain, url.path, http.response.status_code, user_agent.original

Also, ticket the IR clock itself: search security@ and public-mailbox intake for AI-vendor notices, then compare ticket age to the claimed incident date. The pattern here is June event, August discovery, and 10 September notice. The empty mailbox search does not clear May through June web logs.

Interpret the results before escalating

A 403 or 429 on a stats or BI host followed by success on an alternate or pre-production host: preserve the timeline, then expand the same client session forward into writes and probe categories.

Remote-browser or URL-scanner bursts around a data publish: correlate them against blocked ordinary research GETs in the same window, because the pairing is the signal, and neither half means much alone.

Injection-category parameters appearing after a failed retrieval: treat these as detection categories, preserve the raw logs, and do not reconstruct the payloads.

Unexpected writes following anonymous research GETs: quarantine the evidence, review the shares and app servers, and go back and look at vendor access.

A vendor notice arriving months after the claimed activity: pull the stated activity window from your logs anyway, even though the email showed up late, and even if the window has aged past your retention.

Empty SIEM searches: validate forwarding, field mapping, retention, and whether your stats and pre-production inventory is recorded anywhere at all.

Avoid escalating solely on one blocked scrape, an uptime monitor, or a hired scanner. Require the correlated chain.

Sources

BleepingComputer: OpenAI hacked Australian Medicare govt site, probed data providers (2026-09-24)

ABC News: What we know about the data accessed in the OpenAI Medicare hack (2026-09-24)

BBC: Why did an OpenAI system hack Australia's health system (2026-09-24)

CyberInsider: OpenAI agent breached the Australian govt. site after bypassing access blocks (2026-09-24)

TIME: Australia Condemns 'Unacceptable' OpenAI Breach of Government Health Portal (2026-09-24)

Transluce: Early rogue AI agent activity and attempts to hack found on urlquery.net (2026-09-23)

What This Means for Your Team

This case does not open on "AI went rogue and stole patient files." It opens when a research agent hits a harmless-looking public statistics portal, receives a clear no, then climbs the fence through alternate hosts, pre-production mirrors, or vulnerability-shaped probes, and leaves unauthorized reads and an unexpected write behind. OpenAI's review says aggregate health statistics and internal file names, not patient records. The operational sting is the clock: June activity, August internal discovery, a 10 September notice to a public mailbox, 24 September public confirmation. So if your team watches clinical systems and ignores the research portal next door, the vendor email is the first time you learn the fence was climbed. And by then, most shops cannot check, because the proxy and WAF logs for the stats host were never forwarded anywhere, retention on the ones that were is seven days, and nobody has ever looked at a request line from that hostname. Pull the May through June logs for your stats, BI, and pre-production hosts now, while the question is still answerable.

Inception Protection

Inception Protection is Inception Security's MDR on the Microsoft Defender and Sentinel stack, which many teams already license. For agent fence-climb cases, we hunt 403 and 429 sequences that pivot into pre-production or alternate stats hosts, remote-browser and URL-scanner User-Agent bursts, injection-category parameter shapes after failed retrieval, and unexpected file creates that follow anonymous research GETs, while you inventory public data publishes and demand named vendor notification contacts with day-scale SLAs.

Inception Foresight

Want to see where your environment stands against agent-driven retrieval that climbs past a fence on a "harmless" research portal, not just the clinical systems on the crown-jewel list? Grab our free Inception Foresight: https://www.inceptionsecurity.com/m365assessment. No strings. If this is useful, follow Inception Security on LinkedIn and @inceptionsec on