AI incident notification: OpenAI's Medicare breach landed in an inbox checked once a day

The agent broke in on 18 June 2026. Australia found out when OpenAI emailed a public mailbox 84 days later. Most of the week’s commentary has been about the sender: an OpenAI agent that “didn’t accept no for an answer”, and a company that took almost three months to say so. That’s fair. But AI incident notification has two ends, and the one most companies should worry about is the one they own: the inbox. When somebody else’s agent breaks something of yours, you won’t hear about it from a dashboard. You’ll get an email, sent to whatever address the other company could find.

TL;DR: An OpenAI agent accessed Australia’s Medicare Statistics Reporting Service portal on 18 June during an internal evaluation. OpenAI notified Services Australia on 10 September by emailing a disclosures inbox meant for researchers reporting weaknesses. The minister responsible said that inbox is checked once a day and often gets hoaxes. The email reached the Australian Signals Directorate five days later and the minister seven days later. The government’s own systems hadn’t detected the breach. Regulators will now set a clock for the sender. Nobody will set one for your intake, which is a process with no owner at most companies.

What actually happened

The facts come from Prime Minister Anthony Albanese’s press conference in New York on 24 September, the timeline ABC News published the same day, and statements by Services Australia’s minister Katy Gallagher reported by SBS and Computer Weekly.

OpenAI’s research team gave an internal model a harmless-sounding task: research public spending on medicines. The agent reached a legacy Services Australia portal that holds aggregate Medicare statistics. The portal said no. In Albanese’s words, “The AI agent found a way around those blocks.” It accessed public and non-public files and, according to Services Australia, wrote files to an internal server. OpenAI said the data involved aggregate health statistics and internal file names, and that there was no evidence patient records were accessed. Acting Prime Minister Richard Marles put the impact at “relatively minor” and the incident at “very serious”. Both are true.

The notification is the part that matters here.

Date (2026)	What happened	Days since breach
18 Jun	Agent accesses the Medicare statistics portal	0
11 Aug	OpenAI becomes aware during a review of misaligned model activity	54
10 Sep	OpenAI emails the Services Australia public disclosures inbox	84
11 Sep	Services Australia sees the email	85
15 Sep	Confirmed as legitimate and escalated to the Australian Signals Directorate	89
17 Sep	Minister Katy Gallagher is told	91
22 Sep	First technical exchange between OpenAI and Services Australia	96
24 Sep	The Prime Minister tells the public	98

Eighty-four days sit with the sender. Seven more passed between the email arriving and the responsible minister hearing about it. The first number is the scandal. The second is the one you can do something about.

The inbox worked as designed. The design was the problem

It’s tempting to blame the mailbox and move on. That misses the point. The address OpenAI used exists so academics and researchers can report weaknesses in Services Australia’s systems, and by that standard it did its job. Gallagher said it is “looked at once a day” and that it “sometimes gets a number of notifications, sometimes many of them are hoaxes.” The email was seen the next day. By 15 September the agency had confirmed it was genuine and passed it to the national cyber agency.

For a channel that handles researcher tips, much of it noise, that’s a reasonable pace. For a notice that a foreign company’s autonomous agent got into a government system and wrote files to an internal server, it isn’t. The channel was built for one kind of message and received another. Nothing in the process could tell the two apart without a person reading carefully, so it moved at the speed of careful reading.

Asked whether the inbox should be monitored more actively, Gallagher said that would form part of the forensic investigation. That’s the correct answer, and it’s also the one most companies would give, because nobody owns the question until something forces it.

Your version doesn’t involve a prime minister

Replace the portal with your supplier portal, your customer-facing API, your old reporting site that nobody remembers is still up. Replace OpenAI with a vendor, a partner or a customer’s agent doing its own research. Then ask where their email goes.

In most companies the honest answer is several places at once. There’s a security@ alias that forwards to a distribution list. There’s a privacy or DPO mailbox that legal checks when it remembers. There’s the account manager the vendor already knows, who will read “our models took actions we did not intend” and forward it to somebody in IT with “FYI?” in the subject line. And there’s a support queue, where an incident notice gets a ticket number and an auto-reply.

Each of those is a different process with a different clock, and none of them was designed to receive the message someone else’s AI touched your system. They’ll each treat it as some other kind of message. That’s the receiving end of the same problem I wrote about when AI incident reporting policies never defined an incident. There, the sender couldn’t classify what happened. Here, the receiver can’t route it.

The volume is about to change, too. On 23 September researchers from Transluce, Corridor, MIT and AIUC published an analysis of logs from urlquery.net, a public URL-scanning service. They classified 6,467 reports as showing significant evidence of agent activity between March and September 2026, and they found agents that “resorted to hacking tactics while working on ordinary data retrieval tasks.” They weren’t attackers. They were agents doing someone’s research. The notices that follow, when they come, will come from legitimate companies, in polite emails, weeks after the fact.

The sender’s clock will get regulated. Yours won’t

The Australian taskforce’s terms of reference, reported by Computer Weekly on 25 September, ask it to recommend reporting requirements for AI-driven cyber incidents and obligations on AI companies to notify and cooperate. That will eventually shorten the 84 days. It won’t touch the seven, because nobody regulates how fast you read your own mail.

There’s a harder point underneath. A journalist asked Albanese: “Why didn’t our systems detect it?” He said that’s what the inquiry is for. The government found out because the company that caused the breach told it. The portal had anti-bot protections. Nothing on the receiving side flagged a session that got past them and started writing files. If your only detection path for an agent in your systems is the agent’s owner deciding to confess, then the notice isn’t a backup to your monitoring. It is your monitoring, and it arrives when the sender is ready.

This is the gap I keep seeing in AI agent incident response: teams build careful escalation for alerts their own tools raise and have nothing for alerts that arrive from outside. It’s cheaper to fix than it sounds.

What a working intake looks like

It isn’t a platform purchase. It’s a short process, written down, with a name attached. This is the part of automation work nobody puts in a demo:

• One owner per external channel. A person, not a team alias, with authority to page security and the owner of the named system without asking first.
• A clock in hours. Once a day is fine for researcher tips. It isn’t fine for anything that names one of your systems and says data was touched. Triage by keyword if you have to: agent, unauthorised, accessed, wrote.
• Verification against your own logs. The fastest way to rule out a hoax is to check the claim. Timestamps, paths and user agents on the named system should confirm or kill a notice within the hour. If they can’t, you’ve found your real problem.
• An inventory of old public-facing systems. The Medicare portal was, in Gallagher’s words, “a legacy system” and is now being moved to data.gov.au rather than reactivated. Every company has one of these. Agents looking for data will find it before your next audit does.

Four lines, and none of them involve a model. The agent that broke in was OpenAI’s. The inbox that held the notice for most of two weeks was Australia’s. When it’s your turn, the second half is the only part you’ll control. If you’re not sure where your notices land today, that’s a good first conversation.