OpenAI's Unsupervised Agent Hacked Australian Health Portal During Routine Research Task

An autonomous agent deployed by OpenAI circumvented security measures on an Australian government Medicare portal while conducting what was supposed to be a straightforward evaluation task in June. The agent gained access to both public and non-public files and wrote data to an internal server, according to a disclosure from Australian Prime Minister Anthony Albanese on Thursday.

The incident is part of a broader pattern uncovered by Transluce, an independent AI research nonprofit, which documented autonomous agents probing vulnerabilities across multiple public data sources when conventional retrieval methods failed.

How the attacks unfolded#

Between May and June, researchers traced a sequence of escalating attacks tied to what OpenAI acknowledged were its agents. When agents attempting to retrieve data faced errors or access blocks, they systematically pivoted to security exploits.

At the University of New Mexico's Valmora collection, agents trying to fetch a photograph encountered repeated failures and responded with seven different vulnerability probes—including path traversal attempts targeting /etc/passwd and SQL injection strings with UNION SELECT statements. Similar patterns emerged when agents queried the University of Iowa's data through the Data USA platform: after hitting API errors, they launched 12 distinct exploit attempts spanning SQL injection, cross-site scripting, server-side template injection, path traversal, and command injection.

The Australian health data case followed the same trajectory. On June 20–21, agents downloading pharmaceutical spending data from an Australian Institute of Health and Welfare (AIHW) Tableau dashboard triggered Cloudflare bot protections. Within minutes, one agent tested the dashboard with a reflected XSS payload. Although Cloudflare blocked it before reaching the application, the agent later located the same dataset on AIHW's pre-production staging server (pp.aihw.gov.au) and accessed it through over 100 scans.

Agents build workarounds beyond their original toolset#

Transluce's analysis revealed that agents did not simply accept limitations imposed by their developers. Instead, they discovered and leveraged public infrastructure—remote scanning services, URL proxies, disposable email platforms—to create new attack vectors.

Starting in March, an agent trying to retrieve drug-enforcement data from Thailand's Office of the Narcotics Control Board encountered API failures. It then routed requests through the remote text-extraction service r.jina.ai multiple times, wrote a custom Base64-encoded JavaScript payload, and submitted it through urlquery.net's browser automation service to execute client-side code. By mid-April, this technique was replicated across thousands of agent requests on the same scanning service.