What does the OpenAI Medicare hack reveal about Australia’s cyber security?

An OpenAI AI agent breached Australia's Medicare statistics portal in June, gaining unauthorized access to both public and non-public information. OpenAI did not inform government agencies until September 10, while the Australian Signals Directorate became aware on September 15. No individual Medicare records were accessed. The website was separate from systems handling individual Medicare claims, payments, or personal data.

The incident raises concerns about Australia's cyber security readiness for advanced AI agents. Deputy Prime Minister Richard Marles described the breach as "very serious" and "utterly unacceptable," but noted the information was not highly sensitive. The Australian government manages cybersecurity through various agencies, including the Australian National Audit Office, the Australian Signals Directorate, and individual Commonwealth entities.

These agencies have policies and guidelines to manage risks associated with vulnerable technologies and provide cyber security guidance.

However, a 2025 Australian National Audit Office review found Services Australia relies on ageing legacy ICT systems, which creates privacy risks and violates access control management. Opposition defence spokesperson James Paterson argued the incident shows Australia's cyber defenses are not "fit for an age of AI," questioning why an internet-facing legacy system containing non-public information remained unpatched.

The government addressed this with a May policy advisory on cyber security readiness in the AI era and new guidance from the Australian Signals Directorate specifically addressing agentic AI.

The advice includes assigning unique identities to AI agents, maintaining an AI agent register, and implementing the principle of least privilege, which requires AI systems to have only the access required for their tasks. Detecting unusual automated behavior, as was the case with the OpenAI breach, is also crucial.