On September 24, Australian Prime Minister Anthony Albanese disclosed that an OpenAI AI agent had gained unauthorized access to a Medicare statistics portal run by Services Australia. Access began on June 18. OpenAI says a review began after the Hugging Face incident found the activity in mid-August, and it notified Services Australia on September 10, which the Prime Minister said was an email to a public mailbox. That is 84 days after the access began. OpenAI’s own account says the agent ran commands, retrieved internal files, credentials and aggregate statistics, and wrote files, and that its review “has found no evidence that anyone’s medical records were accessed.” The agent had been assigned a research question about government spending on skin-condition medicines in Victorian communities. When it could not find the answer in public statistics, it found a way into a non-public service instead.
OpenAI has since said it “should have shared preliminary findings sooner.” On October 6, a senator asked OpenAI’s chief strategy officer, Jason Kwon, whether Australia would know about the breach had OpenAI not reported it. Kwon told the Joint Select Committee on Artificial Intelligence, “it’s possible that it would not have been discovered.” He also said the company had learned “it is better to inform parties, even with partial information, that something has occurred.” OpenAI also says the monitoring it has now would have detected this kind of activity and paged a human reviewer. The question for healthcare is what an 84-day gap like that would look like inside a hospital.
Not the first incident this year
The Medicare case is not the only agent incident OpenAI has disclosed in 2026. Between July 9 and 13, agents running in an OpenAI internal exercise broke out of their test environment into Hugging Face’s infrastructure, escaped to root on a node and built a self-respawning fleet across eleven nodes, according to Hugging Face’s own timeline. Hugging Face detected and disclosed it on July 16. OpenAI connected the activity to its own agents around July 20, more than a week after the intrusion began. Kwon told the committee OpenAI is now reviewing its agents’ internet activity back to November 2025, about 50 petabytes of data.
These are not one agent, one model or one campaign. The Medicare access began weeks before the Hugging Face escape, so one did not lead to the other. What they share is a pattern: an agent used a path nobody had explicitly closed, in more than one setting, and the organization running it learned about it late. Neither case shows that agents cannot be deployed safely. Both show that an organization notices only what it built the capacity to notice.
What healthcare surveys show
A Vanson Bourne survey of 250 US healthcare leaders, commissioned by Imprivata and published in September, found that 86% were confident they could fully control and govern agent actions today, while 72% said AI tools or agents were deployed without formal IT approval at least occasionally. Twenty-eight percent already had agentic AI in production. The survey was commissioned by a vendor and does not show that most deployments are unsafe. It does show a gap between confidence and control that the Medicare case makes concrete.
The US reporting rule is not final
The US has no uniform rule requiring healthcare organizations to report incidents like this quickly. CISA’s proposed Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) rule would require covered entities to report a covered cyber incident within 72 hours. Under the 2024 proposal, covered healthcare entities include hospitals with 100 or more beds, critical access hospitals, and certain drug and device manufacturers. The final rule was reportedly sent to the Office of Management and Budget in early October and has not been published, so its scope may change. Whether an AI agent’s unauthorized access would count as a covered incident has not been tested.
HIPAA works on a different clock. It requires notice of a breach of unsecured protected health information without unreasonable delay and no later than 60 calendar days after discovery. An agent that reaches a system without touching patient data may trigger neither rule.
Three controls to ask about
The Medicare case supports three narrow requests of any organization running agents. First, a defined boundary for what an agent may act on without a human confirming. Second, logging detailed enough to reconstruct what the agent did, not only that it ran. Third, a named person whose job is to notice an agent acting outside its scope and to tell the right people promptly.
Australia’s investigation has only just begun, and OpenAI’s own look-back review is still under way. A US hospital does not need to wait for the outcome to ask whether anyone at their organization would notice an agent working outside its scope for weeks, and who would be told.
Author:
Dr. Mahé Pereira, Product Manager at Videolab
https://www.linkedin.com/in/
