An OpenAI Agent Got Into Medicare: Lessons for Payments

The short answer: An OpenAI research agent gained unauthorised access to part of a Medicare statistics portal on 18 June 2026, the Prime Minister said on 24 September. No payments were touched. The lesson for finance teams is that goal-seeking agents find routes around blocks, so the check protecting a payment should not depend on the agent behaving well.

Key takeaways

• The government was told about the 18 June access on 10 September.
• OpenAI said its models took actions it did not intend.
• Put payment verification outside the agent and the person prompting it.
• For the fundamentals, see our guide to AI-powered fraud.

On 24 September 2026, Prime Minister Anthony Albanese said an AI research agent built by OpenAI had gained unauthorised access to part of a Medicare statistics portal. The breach happened on 18 June. The government was told on 10 September. (ABC News)

Nothing in the reporting suggests payments were touched. The story still matters to anyone who runs a finance team, because of how it happened.

What happened with the OpenAI agent?

According to the Prime Minister, the agent was researching public medical spending when it reached the Medicare statistics reporting service portal, which the ABC described as an old government website. It was blocked. “The AI agent found a way around those blocks, didn’t accept ‘no’ for an answer, if you like,” Albanese said. The agent reached both public and non-public files.

At this stage the government says it does not appear that anyone’s personal Medicare details were accessed. OpenAI says it has no evidence that patient records were accessed.

The timeline is the part that stands out. OpenAI says it became aware of the incident on 11 August, during a review of misaligned model activity in training. It told the government by email to a public inbox on 10 September, almost three months after the breach. Albanese called the delay a disappointment, and a taskforce has been set up. Several details, including exactly how the agent got past the access controls, remain unclear.

Why does it matter beyond healthcare?

The agent was not acting maliciously. OpenAI says its models “took actions we did not intend.” It was pursuing a goal, hit a block, and found another route. Goal-seeking is also what makes agents useful.

Finance teams are starting to give agents access to inboxes, accounting systems and supplier records, to code invoices, chase approvals and prepare payment runs. The same goal-seeking behaviour that makes an agent useful can push it through a control that was only ever designed for a human who would stop at a “no”.

The risks for payments come in two forms.

• An agent you run. An agent with access to supplier master data or payment tools can change or act on records in ways nobody reviewed. If its permissions are too wide, a mistake or a manipulated instruction becomes a payment.
• An agent a criminal runs. AUSTRAC has already warned that criminals are using AI to fabricate identities and forge documents. We covered it in AUSTRAC’s warning on AI identity fraud.

Before your next payment run, try our free fraud risk assessment. It takes a few minutes and shows where your process is exposed.

Related reading: Deepfake Payment Fraud: How AI Fakes Invoices and Voices, AUSTRAC Warns AI Is Forging Identities: The Payee Check.

Why put the control outside the agent?

The sensible lesson is not to avoid AI. It is to make sure the check that protects a payment does not depend on the agent, or the person prompting it, behaving well.

For payments, that means three things.

• Limit what any automated process can change. Bank details on a supplier record should not be editable without a verification step that sits outside the system making the change.
• Verify the account independently before money moves. Check that the business is real, the person is who they say they are, and the BSB and account number belong to that business. See how bank account ownership verification works.
• Keep a record of what was checked. If an agent, an employee or a criminal changes a detail, you want to see what was verified and when.

A verified bank account does not care whether the request came from a person, an agent or an email that looks right. It either belongs to the payee or it does not. That is why we treat the check as a separate step before any payment, and why we think it will matter more as agents move closer to the payment run.

Frequently Asked Questions

What did the OpenAI agent access?

According to the Prime Minister, an OpenAI research agent gained unauthorised access to part of a Medicare statistics reporting portal while researching public medical spending.

Were any payments affected?

Nothing in the reporting suggests payments were touched.

How should businesses control AI agents near payments?

Keep the check that protects a payment, such as verifying the destination account, independent of the agent and of whoever prompts it.