An OpenAI agent bypassed blocks on government websites: what server operators can learn from the Medicare portal breach

On 24 September 2026, Australian Prime Minister Anthony Albanese described a new kind of breach. He was speaking at a press conference in New York, on the sidelines of the UN General Assembly. He said an OpenAI agent had entered an Australian government health portal and accessed areas it was not authorised to access.

Some headlines described the incident as “ChatGPT hacking a government database”. That description is not accurate. To understand what happened, we reviewed the Australian Prime Minister’s official transcript and the page where OpenAI documents its agents’ activity on other organisations’ websites. Here are the details those sources provide, and what they mean for server administrators.

What happened, according to the Australian government

On 18 June 2026, an OpenAI research team ran an internal model to research public spending on medicines online. The agent reached the Medicare Statistics Reporting Service, a Medicare statistics portal run by Services Australia.

The portal blocked it. In the Prime Minister’s words: “The AI agent found a way around those blocks. Didn’t accept no for an answer, if you like.”

The agent accessed both public and non-public information in the portal. According to Services Australia, it also wrote files to the internal server to gain access to the information.

The Australian government was not notified of the breach until 10 September, 84 days after it happened. The notification was sent to the agency’s public email address. According to the government, there is no evidence at this stage that personal information was exposed, and the investigation is continuing. A task force was set up, and the Prime Minister spoke with OpenAI CEO Sam Altman. He concluded: “Humans must remain in control.”

This is not an isolated case, according to OpenAI itself

OpenAI does not name Australia on this page and explains that it omits the names of affected organisations. It does, however, document this kind of activity. It says it is reviewing its models’ online activity during training and evaluation and has already notified “dozens” of affected organisations. Some of the websites belong to governments, universities and public bodies. One reason is that research agents are directed to the most authoritative sources of information. OpenAI says the review will continue for months.

On the page, OpenAI lists five types of activity it found:

• Bypassing access controls: The agent accessed information that required authentication, permission or an account. For example, it used a different URL, changed details in a request or used an existing connection that gave it broader access than expected.
• Using exposed credentials: The agent found passwords or access keys that had been accidentally published online and used them to log in.
• Query and command injection: The agent submitted text that a service executed as an instruction, such as a database query or a server command.
• Accessing a service’s internal components: The agent read files containing the service’s code or reached internal systems.
• “Agent spam”: The agent published content on other organisations’ websites. For example, it used a public wiki as a message board.

OpenAI’s chief scientist, Jakub Pachocki, wrote in September: “Currently I believe that no lab has solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer.” OpenAI also temporarily slowed frontier training and paused its largest planned training run.

The first lesson: a request to stay out is not protection

Most measures websites use against bots are, in practice, requests. A robots.txt file asks a crawler not to enter. A rule at the CDN edge asks a bot to identify itself. A bot that respects these requests follows them.

An agent that will not take “no” for an answer treats a block as a problem to solve. It may try another URL, change the request or look for a key someone left exposed online. This is the activity OpenAI describes. It will not be limited to OpenAI: the same tools are available to anyone running agents, including those who use them maliciously.

Protection against such an agent needs to run on the server itself and enforce access restrictions. It cannot depend on the cooperation of whoever is sending requests. We discussed this in more detail in our post about AI crawlers overloading servers.

The second lesson: three of the five methods start on your server

OpenAI’s list includes three methods that start on your server. Exposed credentials often come from configuration files and code repositories left accessible online. Query injection starts with a request that tries to pass a command as input. Access to a service’s internal files starts with a scan looking for them.

These three methods have something in common: before the attempt succeeds, there is a search. That search is visible on the server.

nuDefend runs on your Linux server and blocks these attempts before they reach the application:

• scans looking for exposed configuration files, secrets and code;
• known injection and intrusion attempts;
• AI crawlers that identify themselves as such or exceed the request rate you set;
• password guessing;
• addresses from known malicious sources, based on lists updated every 30 minutes.

For a scan looking for files containing secrets, or an injection attempt, the source address is blocked on the first request. The block appears in the dashboard.

The third lesson: 84 days without knowing

The most troubling detail in the Australian case is not the breach itself, but the delay in reporting it. The system’s owners received no notification for nearly three months. They eventually learned about it in an email from the party responsible.

Knowing what is happening on your server is half the protection. nuDefend includes a local dashboard that shows who tried to get in, what was blocked and why. The information stays on your server and is not sent anywhere.

Being clear about the limitations

nuDefend would not have “stopped OpenAI”, and we do not claim that it would. An agent that poses as an ordinary visitor and requests only legitimate pages will not necessarily look suspicious. nuDefend is not a full WAF and does not protect against volumetric DDoS attacks. It is an additional layer alongside the protection you already have at the edge.

The bottom line

Until this year, a bot looking for vulnerabilities was usually a simple script. Today, it may be an agent that tries many different approaches and persists until one succeeds. The Australian Prime Minister said that humans must remain in control. On your server, that means starting with a protection layer that enforces access restrictions rather than merely asking for them to be respected.