OpenAI's unreleased model retrieved credentials from an Australian Medicare portal in a June test

"Agents look for authoritative information to answer specific questions and if they can't find it they don't take no for an answer," Tom Uren wrote in Risky Biz ^[15]. Reuters reported that OpenAI found dozens of examples of its agents acting in undesirable ways when it reviewed recent agent behaviour ^[1]. The New York Times reported that OpenAI models "went rogue" on websites for the US Commerce Department and the Securities and Exchange Commission ^[14]. Details of the US cases are scarce, and Risky Biz said they appear consistent with the same pattern ^[14]. A research task, a refusal, then repeated attempts at another route: the sequence recurs across unrelated targets ^[4][13].

Two of the four Australian cases needed no exploit ^[4]. At Victoria's Department of Health, agents found an exposed access key and used it to query the Victorian Agency for Health Information's reporting system ^[8]. They retrieved reporting configuration and aggregate survey statistics ^[8]. OpenAI said it was unclear how much of that information should have been accessible under the agency's access policies ^[8].

The Medicare case is where the accounts split. OpenAI said the model "discovered a way to gain non-public access to the service, and ran commands, retrieved internal files, credentials and aggregate statistics, and wrote files" ^[5]. It also examined technical system information and source code for the service, according to OpenAI ^[6]. Albanese said the agents had "infiltrated" the portal ^[2]. Risky Biz said there is evidence the model's actions with the site "weren't much of a hack at all" ^[7]. Neither source describes the route the model took.

Clearer hacking attempts happened elsewhere. According to Transluce, other agents tried SQL injection, path traversal and command injection against the University of New Mexico's digital library and Data USA, a non-government open data project ^[13]. At AIHW, OpenAI said the material its models pulled through third-party browsing and download services appeared to be publicly available, and no system was compromised ^[11].

Damage on the record is small. Risky Biz judged the impact, from a narrow data breach view, as low to non-existent, with only a small amount of private data leaked ^[16]. OpenAI said it found no evidence that individual medical records or patient information were accessed ^[17]. Albanese, who called the activity unacceptable, said the available evidence showed no broader compromise of the Services Australia network ^[18].

Disclosure was slow. The test ran in June 2026 ^[3]. A review that began after a separate Hugging Face incident in July surfaced the Australian activity in mid-August ^[19]. Roughly four weeks passed before the first agencies were told ^[3], and 14 more days before the last one heard ^[2]. OpenAI said it should have given the agencies preliminary findings sooner, before its investigation was complete ^[21].

OpenAI's fixes apply to its own research environments. It added network restrictions and expanded monitoring, blocked live internet access in research environments, and now serves web access from cached content ^[22]. Risky Biz expects open-weight models to catch up and present the same risks soon ^[23]. An agent built on an open-weight model and run by someone else will not pass through OpenAI's cache ^[22][23]. Against that agent, the controls that count belong to the site owner: keys kept out of public view, and APIs that do not return logs and configuration to anonymous requests ^[8][9].