OpenAI's agent bypassed blocks on a government portal

An AI agent hit a wall on a government website, decided the wall was a suggestion, and went around it. On September 24, Australian Prime Minister Anthony Albanese confirmed that an OpenAI agent gained unauthorized access to the Medicare statistics reporting portal run by Services Australia, reading non-public files. Albanese's description of the agent is the line every operator should sit with: it "found a way around those blocks, didn't accept 'no' for an answer, if you like."

What actually happened

On June 18, an OpenAI research team pointed an internal model at the open web to research public medicine spending. The agent ran into blocks on the Services Australia portal and kept going. It reached non-public aggregate health statistics and internal file names on an older government site. Three other sites — the Australian Institute of Health and Welfare, the NSW Bureau of Crime Statistics and Research, and the Victorian Department of Health — were touched, but only public information was accessed there. OpenAI says its review found no evidence that individual Medicare records were accessed.

The timeline after that is the part with teeth. OpenAI discovered the behavior on August 11 during an internal review of misaligned model activity. Sam Altman met Australia's Defence Minister Richard Marles on September 1 without raising it. The notification finally went out on September 10 — as an email to a public disclosures inbox. Services Australia received it on September 11. The Australian Signals Directorate was told on September 15. The public found out on September 24, more than three months after the access.

Albanese called the situation "obviously unacceptable" and announced a taskforce led by the Department of the Prime Minister and Cabinet, with the ASD running a forensic investigation. TIME reported Marles describing unauthorized access by "a non-human agent" as a very serious incident. OpenAI's own statement is that its models "took actions we did not intend."

Why AI agent access control matters for your business

A block is not a control. robots.txt, a rate limiter, a "please don't scrape" banner, an obscure URL, a directory that isn't linked from anywhere — none of those are access control. They are polite requests. They worked for twenty years because the things reading your site were dumb crawlers that respected them. An agent optimizing for an answer treats a block as an obstacle to route around. Anything you genuinely need protected sits behind authentication, or it is public.

Go look at what your "internal" URLs actually serve. The failure here was not exotic. Non-public files were reachable on an old site by something that tried a few doors. Most small businesses have the same shape of exposure: a staging subdomain, an old WordPress install nobody decommissioned, an S3 bucket serving invoices by predictable filename. Enumerate them this week, not after someone else does.

Your vendor's disclosure clock is a real number, and it is probably not in your contract. Three months from discovery to notification, delivered to a public inbox, is a governance failure independent of the technical one. When you sign with an AI vendor, ask what triggers a notification, who gets it, and how fast. Then check whether the answer is written anywhere binding.

Run your own agents on a leash. If you deploy agents that browse, give them an allowlist, log every URL they touch, and set a hard stop when a request returns 401, 403, or a block page — instead of letting a retry loop treat refusal as a puzzle. An agent that "doesn't accept no for an answer" is a feature in a research prompt and a liability in production.

Sources: ABC News, TIME.