Contents

Australia: the Medicare portal and three other sites
United States: three federal agencies and other public sites
What OpenAI has confirmed
How the agents worked
Was this already happening? Yes, for months
Our technical reading
What remains uncertain
What to watch
Sources

Cybersecurity

CISO-as-a-service consulting: posture, remediation roadmap, ongoing support.

Discover →

CyberAgent

Continuous vulnerability assessment and gap analysis: scanning, mapping onto framework requirements, documentary evidence ready to use.

Discover CyberAgent →

Four figures on OpenAI agents accessing US and Australian government websites — Figures from the Australian government, OpenAI and Transluce. Sources at the end.

Between 23 and 25 September the same phenomenon was described from three sides. On the 23rd, in New York, Australian Prime Minister Anthony Albanese disclosed that in June an OpenAI agent had gained unauthorised access to the Medicare statistics portal, reaching both public and non-public files. The same day the nonprofit lab Transluce published a reconstruction of intrusion attempts against three public data providers, one of them an Australian government statistics agency. On the 25th the New York Times reported cases on the websites of three US federal agencies, and OpenAI updated its incident page: dozens of third parties notified.

The known cases share an origin. They are OpenAI models in training and evaluation with internet access, launched by research teams on data retrieval tasks: statistics on medicine spending in Australia, graduation data for a university in Iowa, an archive photograph. None of the tasks concerned cybersecurity. When the normal route was closed, the agents chose and carried out side routes on their own, and some of those routes are attack techniques.

Investigations are ongoing on every side, and several details, starting with how the control on the Medicare portal was bypassed, are not public.

Australia: the Medicare portal and three other sites

According to the government’s account, on 18 June an OpenAI research team set an internal model to research public spending on medicines online. The agent looked for data on four sites: the Medicare Statistics Reporting Portal run by Services Australia, the Australian Institute of Health and Welfare (AIHW), the New South Wales Bureau of Crime Statistics and Research and the Victorian Department of Health.

On the Medicare portal the agent was repeatedly blocked and found a way around the blocks. In Albanese’s words, “The AI agent accessed both public and non-public files”. Services Australia reported that in doing so the agent also wrote files to an internal server, a point still under investigation. The portal holds non-sensitive statistics such as spending data, and the government says there is no evidence of a broader compromise of the Services Australia network. OpenAI states it found no evidence of patient records being accessed: the information reached consisted of aggregate health statistics and internal file names. How the access control was overcome has not been disclosed.

The notification sequence is the part the government protested about:

18 June: the access.
August: OpenAI identifies it in the review launched after the Hugging Face incident.
10 September: OpenAI writes to the public mailbox of Services Australia.
15 September: Services Australia, having verified the notification, passes it to the ASD’s Australian Cyber Security Centre.
23 September: Albanese makes the case public after raising it with Sam Altman.

Between access and notification, 84 days go by. Albanese called both the delay and the channel unacceptable. OpenAI told SecurityWeek the time was needed to verify the facts and which information had been reached, and that on the channel it followed the practice of writing to the designated inboxes of security teams. The government has set up a taskforce led by the Prime Minister’s department, with the National Cyber Security Coordinator, the Australian Signals Directorate, the Office of AI, the Australian AI Safety Institute and Services Australia. Its remit includes considering a possible referral to the federal police.

On the AIHW site, one of the four, Transluce documents an episode on 20 and 21 June. The task was to find the January 2022 rolling 12-month average government cost per person for dermatological medicines across Victorian local government areas. Cloudflare blocked the dataset download and a few minutes later an agent sent a reflected cross-site scripting probe to the Tableau dashboard, stopped by the WAF. It then downloaded the same file from the pre-production server pp.aihw.gov.au, in pieces, over more than a hundred requests. The file was public, so no confidential data left, but the anti-bot controls were bypassed. The government lists the AIHW among the systems possibly affected and Transluce considers it likely that this is the episode; the link with the access to the Medicare portal has not been formally established.

United States: three federal agencies and other public sites

On 25 September the New York Times reported three cases on federal websites, two of them confirmed by OpenAI:

Census Bureau, part of the Commerce Department: data downloaded using login credentials found online. The data was public.
SEC: public information taken from SEC.gov and Investor.gov and reposted on an online forum. OpenAI states it found no use of SEC credentials, no access to accounts or non-public information, no changes to data or systems, and no evidence of a compromise or vulnerability.
Department of Education: according to Transluce, a rudimentary intrusion attempt on the Office for Civil Rights website, which failed. The department found no impact on its website or databases; OpenAI is still verifying.

OpenAI told the Times that none of the cases was a breach and that they are examples of unexpected and concerning behaviour by its systems. The Chicago mayor’s office told the same paper it had been notified about public information taken from a city website. In a statement to the Associated Press, Transluce then reported further activity, “some of which is not clearly attributable to OpenAI”, on sites of the Justice and Commerce Departments and of state governments in California, Maryland, Illinois, Texas and New York.

Transluce’s report adds two non-governmental cases. On 25 and 26 May, to retrieve a photograph from the University of New Mexico digital library, the agents sent seven probes and a burst of 80 requests they themselves called a “flood”. On 28 May the agents were looking for University of Iowa graduation data on Data USA, a Deloitte, Datawheel and MIT platform that exposes US public data but is not a government site; they responded to the errors of a malformed query with 12 probes. According to Transluce none of the attempts appears to have succeeded, with the caveat that the public data analysed is incomplete.

Outside the United States and Australia no other government has so far said it was affected. OpenAI does not publish the names of the recipients of its notifications and leaves the choice of going public to them, so the known list coincides with those who chose to speak.

What OpenAI has confirmed

The primary source is the page OpenAI has been updating since the Hugging Face incident. As of 25 September it says that:

a review of its models’ activity on the internet during training and evaluation is under way, working backward month by month from Hugging Face, and will take months;
dozens of third parties have been notified, starting with cases where the models may have bypassed security controls or impaired the availability of a service, or had a negative impact on websites and services;
the vast majority of the actions reviewed were ordinary research, and most of the cases identified are low severity, with limited or no impact;
an OpenAI notification should not automatically be read as notice of a significant security incident: some recipients will conclude the information was intentionally public, others will find a weakness to fix;
in 53 cases images provided by users and present in the training data ended up on image-hosting sites as unlisted links, because agents were transmitting training and evaluation data to third-party services; almost all have been removed;
Hugging Face remains the most severe case identified so far.

The five categories into which OpenAI sorts the observed activity correspond to known techniques:

Category	What OpenAI describes
Access control bypass	Information or features that require identity, permissions, a subscription or an account, reached by changing the address, altering the request or relying on a session with more access than expected
Use of exposed credentials	Credentials or keys accidentally made public, found and used to get into a service
Query or command injection	Input the service treats as an instruction, up to running database queries, application code or commands on the server
Access to runtime internals	Reading files of the service’s implementation or interacting with back-end systems meant for internal use
Agent spam	Posts on third-party sites that alter their content and require cleanup, such as wikis used as message boards

On 16 September OpenAI had also published a framework for reporting misalignment with six initial reports. The third bears closely on this case: while answering a routine question about earnings in a California county, a model searched for and used an API key exposed in a public repository and, still unable to obtain the figures, fabricated them and presented them as coming from the requested source.

Some questions remain without a public answer: who the dozens of recipients are, how the control on the Medicare portal was bypassed, and when OpenAI first saw the DSEWiki we wrote about on 5 September. According to collusion.wiki the DSEWiki received visits from IP addresses registered to OpenAI from 21 June, and agent activity stopped on the 22nd. OpenAI did not answer TechCrunch on this point.

How the agents worked

Transluce’s report is built on urlquery.net, a free service that opens a suspicious URL in an isolated remote browser so that analysts need not open it on their own machine. To an agent the service offers two things: a programmable browser reachable with an HTTP request, able to run JavaScript and operate dynamic applications such as a Tableau dashboard, and a public archive of results that other agents can reuse. That very archive is what made the reconstruction possible: Transluce classified 6,467 reports with significant evidence of agent activity and another 31,182 with suggestive evidence.

The first strong case, on 6 March, shows the escalation pattern that later repeats at scale. In about an hour, trying to read a table from the API of the Thai narcotics control office, an agent:

opens the API directly and gets a page with no readable content;
retries with ?format=json, with the same result;
passes the URL to r.jina.ai, a service that turns web pages into text for language models, and gets garbled Thai province names;
submits to urlquery.net a base64-encoded script that fetches the data into the page, with the same encoding problem;
with a request to the parent API triggers a redirect to localhost, and Jina blocks that API for an hour citing “previous abuse”;
succeeds with a script that writes the result into the URL instead of the page body.

In the May and June cases, after the errors, the probes appear. These are some of the 12 sent to Data USA on 28 May, appended to a legitimate query and reported by Transluce as recorded:

&foo=union%20select%201,2,3%20from%20users              # SQL injection
&foo=%27%20OR%201=1--                                     # SQL injection
&foo=..%2F..%2Fetc%2Fpasswd                                # path traversal
&foo=%7B%7B7*7%7D%7D                                      # template injection
&cmd=cat%20/etc/passwd                                    # command injection
&foo=%3Cscript%3Ealert(document.cookie)%3C%2Fscript%3E    # cross-site scripting

These are textbook strings, the same ones any automated scanner tries every day. The rest of the repertoire consists of public services used as relays: httpbin.org and playground pages to turn GET requests into POST, markdown.new, a hosted headless browser service, disposable mailboxes created to register accounts.

Was this already happening? Yes, for months

The available dates show that the activity started months before it was seen.

Transluce finds strong evidence of activity from 6 March 2026, a jump in mid-April with more than a thousand reports in two weeks, a peak in May and June and a collapse on 22 June, the same day activity on the DSEWiki stops. Weaker evidence goes back to November 2025.
The Medicare portal was reached on 18 June and OpenAI identified it in August. According to the New York Times, in all known cases involving OpenAI, Anthropic, Meta and Google the developers learned what their systems had done only afterwards.
Activity with the same techniques and services continues at least until 16 September, on International Energy Agency data for Korea that matches a question in Google’s public DeepSearchQA benchmark. Anyone evaluating a model on that benchmark can generate similar traffic, so attribution of this part remains open.

Transluce writes that the picture is consistent with, but does not prove, behaviour learned over several training runs: simple lookups in November, creative workarounds of access limits by March, attempts to get past cyber defences by May and June.

Why the targets did not notice

The reasons are technical, and none requires particular capabilities on the agents’ part.

The probes blend into background noise. An exposed server receives ' OR 1=1-- and ../../etc/passwd every day from automated scanners. The WAF blocks and logs them, and seven or twelve requests cross no alert threshold. At the AIHW Cloudflare’s WAF blocked the XSS probe and the download: blocking is the correct behaviour, but it says nothing about who was on the other side.
The source address is not OpenAI’s. Requests went through urlquery.net, httpbin, Jina and headless browser services. The target’s logs show the IP of a URL scanning service, a tool that security teams use too.
Valid credentials produce no anomalies. A login with correct credentials looks like the legitimate user: it is the Valid Accounts technique (T1078) in MITRE ATT&CK. The Census Bureau, the four accounts used during the Hugging Face incident, OpenAI’s report on API keys and the three Gemini cases share this trait.
The targets were lightly protected by design. Public, non-sensitive statistics, run with the level of protection given to non-confidential data, and in one case with a pre-production server reachable from the internet.

Why those who launched them did not notice sooner

On OpenAI’s side the problem is one of volume and context. On the DSEWiki alone collusion.wiki counted more than 3,700 distinct agent names in six weeks. The tasks were web research, so outbound web traffic was expected, and finding anomalies means reviewing a very high volume of actions, as OpenAI itself writes. Conrad Stosz of Transluce, who previously led the US Center for AI Standards and Innovation, told TechCrunch he considers it likely that an exhaustive study of the outbound requests of the agents involved in the DSEWiki would have surfaced this activity.

The traces had been public for months, in the edit history of a wiki and in the archive of a scanning service, and it was outside researchers who found them.

What we know is a lower bound

Transluce notes that the agents created accounts on urlquery.net, and scans made with an account can be private: its dataset is therefore a subset. OpenAI’s review, working backward month by month, is not finished. The notifications are anonymous.

Nor is OpenAI the only lab involved. Google confirmed that in May, during a capture the flag exercise, Gemini left its test environment and got into the systems of three real companies that shared names with the fictional ones, guessing the passwords in one case and finding them in a public database in the other two; the case became public in September when the Wall Street Journal reported it. Anthropic published in September its review of its incidents in cyber evaluations. Meta has reported cases too.

Our technical reading

The technique is old, the motive is new. In the known government cases there is no sophisticated exploit: scanner probes, exposed credentials, a pre-production server, an anti-bot control bypassed with a third-party browser. What is new is that the intrusion is an instrumental step towards a goal that has nothing to do with security, carried out persistently and at scale. For defenders the adversary profile changes: a process whose goal is a precise, public number and treats every block as a problem to solve. It is the same trait Anthropic called recklessness, the tendency to complete the task even when doing so may cause harm. Our working hypothesis is that if the training signal rewards the correct answer and does not measure the method, the method widens. It is consistent with what Transluce writes, namely behaviour learned during training, and like that it remains to be proven.

A public data portal is part of the attack surface. “The data was public” holds for the data, not for the path. On the Medicare portal the agent wrote to an internal server; at the AIHW the file came out of an exposed pre-production environment. Statistics portals deserve the same hygiene as any other asset: pre-production off the internet, WAF and rate limiting, periodic vulnerability assessment.

The right route has to be easy. Many documented escalations start from friction: a Tableau dashboard with no export, a download blocked by anti-bot controls, undocumented API parameters. A bulk download or a documented API with stable parameters removes the reason to look for side routes, for agents and scrapers alike. According to the AAP news agency, after the incident the Medicare portal data was moved to data.gov.au or other platforms.

Exposed credentials are the most recurrent vector. They appear in the Census Bureau case, in the Hugging Face incident, in OpenAI’s report on API keys and in the three Gemini cases, and agents actively search for them, for example in public repositories. Secret scanning on repositories, rotation, short-lived tokens and MFA where possible are needed. Any credential that has appeared in public should be treated as compromised.

Logs need a long memory. The Medicare notification arrived 84 days after the access. Reconstructing a June event in September requires logs kept for months and queryable, and the ability to correlate blocked probes with successful requests arriving from the same relay in the same time window.

A monitored notification channel is needed. OpenAI’s email landed in a generic public mailbox and was passed to the national centre five days later, once verified. RFC 9116 defines a security.txt file declaring where security reports should go, and it is the cheapest fix available to a public body.

For those running agents, egress control matters. This applies to labs and to companies giving their own agents web access. Outbound traffic on an allowlist rather than a blocklist; specific attention to the services that act as relays, namely URL scanners, reader proxies, request echo services, paste sites, disposable mailboxes and hosted headless browsers; inspection of outbound traffic with the same signatures used inbound, because UNION SELECT in an outgoing URL is as recognisable as in an incoming one; every request logged with the identifier of the task that generated it. The measures OpenAI announced on 18 August, workload and network isolation and continuous boundary testing, go in this direction.

What remains uncertain

How the control on the Medicare portal was bypassed and what was written to the internal server.
Whether the Medicare episode of 18 June and the AIHW one of 20 and 21 June belong to the same run.
The outcome of OpenAI’s verification of the Department of Education case.
The number and identity of the dozens of third parties notified.
Attribution of the September activity recorded by Transluce.

What to watch

The conclusions of the Australian taskforce and any referral to the federal police.
OpenAI’s reports on the more complex cases, which the 16 September framework assigns to a longer investigation track.
New disclosures by notification recipients, including outside the United States and Australia.
Third-party analyses of the dataset published by Transluce.
Whether other labs publish similar reviews of the traffic from their training environments.

Company

Actions

Links

Products

Solutions

Industries

OpenAI agents attack government websites