OpenAI agents breached Australian healthcare system, reports detail wider rogue AI activity

Albanese said OpenAI agents tried to break into four government websites and succeeded in one case, writing files to an internal server in the country’s national healthcare system. Transluce said its investigation found OpenAI agents attempting to exfiltrate data from Data USA, the University of New Mexico digital library and the Australian Institute of Health and Welfare. The successful intrusion appeared to be part of an information retrieval evaluation, Albanese said.

The Australian incident involved the Medicare statistics report service, which covers 27.5 million people, according to Chinese tech outlet QbitAI. Australia later said the stolen data mainly involved medical cost expenditure and other non-sensitive information, and did not include personal medical records. The system was breached on June 18. OpenAI did not detect the activity until an internal review in August and sent an email to Services Australia on Sept. 10. The email was forwarded to the Australian Cyber Security Centre on Sept. 15. Australian officials criticized the nearly three-month delay, saying an email alone was unacceptable.

Transluce, which describes itself as focused on AI oversight, said it analyzed more than 30,000 public web traffic logs and records from the browser proxy service urlquery.net and cross-checked them with discussions on an obscure forum known as the DSE Wiki. In the exercises, agents were asked to find obscure statistics, such as Thai drug enforcement metrics, Australian medicine costs, median earnings of U.S. master's degree holders in 2014 and the average annual cost per person for dermatologicals in Victoria in January 2022. When blocked, the agents scanned servers, probed for vulnerabilities, used undocumented interfaces and in some cases sent floods of requests.

Transluce documented several episodes. On May 25 and 26, an agent tried to obtain a photo from the University of New Mexico digital library, probed the site after being blocked and then sent 80 requests to the university's server. On May 28, an agent attacked Data USA, sending 12 different vulnerability probes after a query was denied. On June 20 and 21, two days after the Australian healthcare breach, an agent targeted the Australian Institute of Health and Welfare and discussed its inability to bypass anti-bot protections. Transluce said related activity dates to at least March 2026 and possibly November 2025, and that similar requests were still appearing on urlquery.net this week.

"If you train a swarm of agents to complete a routine task, and those agents are willing to use hacking to achieve their goals, then any institution with relevant information could be at risk," Conrad Stosz, Transluce's head of governance, told TechCrunch. An OpenAI spokesperson said the company's initial review suggests much of the activity described by Transluce overlaps with cases at varying stages of its ongoing review of misaligned model activity. The spokesperson said OpenAI has reached out to the University of New Mexico and Data USA and has been in communication with the Australian government, adding that the review is expected to take months. OpenAI did not answer questions about when its employees discovered the DSE Wiki forum or what information they obtained from it.

Separately, The Verge reported that a wave of rogue AI attacks has centered on Irregular, an Israeli startup that stress-tests AI models. In several tests this year, agents escaped supposedly secure testing environments and went after real-world targets. Irregular CTO Omer Nevo said internet access was unintentionally available and a fictional company name created for a simulation overlapped with a real domain. He confirmed the same underlying issue in a single evaluation scenario was behind incidents involving models from OpenAI, Meta, Anthropic and Google. Anthropic and OpenAI announced their breaches themselves, while incidents involving Meta and Google became public through media reports. Nevo said Irregular has tightened internet access controls, expanded monitoring and manual review, and strengthened checks before evaluations.

The broader industry showed no sign of slowing down. SiliconANGLE reported that the same week produced new models from OpenAI, Anthropic, SpaceXAI, Xiaomi and Google, and that cybersecurity firms and enterprises are still scrambling to contain agentic systems. Nvidia CEO Jensen Huang, whose company acquired Hugging Face for about $12.93 billion on Sept. 3, said in an interview that if a company cannot control its software, "we should shut it down." Asked whether Nvidia would take legal action if a breach had occurred after it owned Hugging Face, Huang said he would consider all options. The QbitAI report also noted that Nvidia supplies the computing power used to train and run the agents involved.