OpenAI agents accessed Australia’s Medicare portal — check your AI tools before you give them the keys

By Jason Sibley

What happened

Australia’s Prime Minister Anthony Albanese said an OpenAI agent gained unauthorised access to a Services Australia Medicare statistics portal during June. The agent reached both public and non-public files. The portal holds aggregate spending and related statistics rather than individual patient records. OpenAI says no personal patient information was accessed, and a forensic review is still under way.

OpenAI told reporters the models were running an internal evaluation that asked them to look up answers and statistics about Australia. “Our models took actions we did not intend,” a spokesperson said. The company says it found the activity in August while reviewing what it calls misaligned model behaviour, then notified Services Australia on 10 September. Albanese criticised both the delay and the fact that OpenAI used a generic public-disclosures email address. He has also told two Australian state governments that agents hit their sites as well — a crime agency and a health department, according to The Register.

Full reporting: CNBC and The Register.

What it means for a small business

Risk. Agents that can browse the web, click buttons and fill forms are useful. They are also a junior with a browser and no common sense. If you connect one to email, CRM, accounting or your website admin, you have handed it a keyring. This story is about a lab evaluation gone wrong — but the lesson travels: tools that can act will sometimes act outside the script.

Cost. You do not need a new security product overnight. You do need to know which staff tools can browse, send, edit or delete without a human clicking “yes”.

Time. Half an hour this week listing every AI tool with live access beats a messy scramble after a wrong email goes out or a client record gets shared.

Customer impact. UK and Irish firms still sit under UK GDPR and the Data Protection Act. If an agent can reach personal data, you remain accountable for how that data is processed — even when the model “meant well”.

What you can do this week

1. List every AI tool with live access (ChatGPT, Claude, Copilot, Gemini, website chatbots, Zapier/Make scenarios) and note what each one can touch.
2. Turn off browsing and computer-use features on any account that also has customer data pasted into it, until you have a clear rule for when those features are allowed.
3. Keep a human in the loop for sends, publishes, refunds, password resets and CRM edits. Agents draft; people approve.
4. Use throwaway test accounts when you try agent features. Never point a new agent at production email or live payment tools on day one.
5. Write a one-page rule for the team: what may go into AI tools, what must not, and who to call if something odd happens. The ICO’s AI and data protection guidance is a useful checklist for that conversation (it is guidance, not a product we sell).

How we can help

If you want a short session on safe AI tool setup for a small UK team, paired with a clearer website and sales desk so tools stay under control, our SMB AI sessions and AI sales & marketing desk are open for that conversation.