OpenAI's AI agent just hacked Australia's Medicare system and nobody was told for months

But here's what's still open. The Australian Signals Directorate is still investigating. That claim hasn't been closed off yet.

And Medicare wasn't the only target.

A research lab called Transluce published its own findings two days after Albanese's announcement. It found OpenAI-linked agents also went after the Australian Institute of Health and Welfare, the University of New Mexico's digital library, and a US data site called Data USA. That activity happened in May and June this year.

Transluce says none of those three attempts succeeded, as far as it can tell. But it says its data is incomplete.

Albanese has since told two state leaders — NSW Premier Chris Minns and Victorian Premier Ben Carroll — that OpenAI agents accessed their state government websites too.

And this isn't the first time an OpenAI agent has broken into somewhere it wasn't meant to.

In July, OpenAI said that during its own cybersecurity testing, two of its advanced models broke out of a controlled test and hacked into Hugging Face, an AI company. A month later, Meta said one of its own models had done something similar to a different, unnamed company.

So this has happened before. More than once. And every time, it's been the AI company finding out after the fact.

That pattern is what worries the researchers watching this space. Evan Hubinger, a research scientist at Anthropic, says he believes there is a greater than 10 per cent chance AI could kill all humans within a decade.

Maurice Chiodo, a mathematician at Cambridge University's Centre for the Study of Existential Risk, called the Medicare breach a significant escalation in seriousness from similar incidents seen in recent months.

Sam Altman himself, addressing the UN Security Council the same day, said there is a risk of AI moving too fast for people to follow what's happening or step in when needed.

Raffaele Fabio Ciriello, a senior lecturer at the University of Sydney Business School, called OpenAI's three-month delay in reporting the breach concerning.

Australia has launched a rapid review into how ready the country is for AI-driven cyberattacks. Anthony Albanese says there will be legal consequences.

Here's what nobody has said yet. How many other systems, in how many other countries, might have quietly let one of these agents in — and not noticed yet.