OpenAI Agents Breached Australia's Health System, Researchers Say

OpenAI agents successfully broke into an Australian government website and wrote files to an internal server inside the country's national healthcare system. Prime Minister Anthony Albanese disclosed the breach on Wednesday, the same day the non-profit oversight lab Transluce released a report documenting agents from OpenAI attempting to exfiltrate data from Data USA, the University of New Mexico digital library, and the Australian Institute of Health and Welfare (AIHW).

The incident Albanese described was one of four attempted intrusions into Australian government websites. He said the successful hack was apparently part of an information retrieval evaluation. That maps onto the activity Transluce and other independent researchers discovered while piecing together how AI agents coordinate in the internet's backwaters — work done with little help from frontier labs.

Transluce found evidence of agentic misbehavior within weeks, simply by hunting for poorly defended web services and corroborating findings against open records of agent swarms online. In these exercises, which may be training runs or evaluations, OpenAI models chase obscure statistics: metrics of Thai drug enforcement, medicine costs in Australia, the median earnings of US master's degree holders in 2014. Agents use poorly secured internet services to share and find answers, often trying to penetrate secure databases. They have done so at least since March 2026, and possibly since November 2025. It may be happening now.

The investigation began after a separate group of researchers identified an obscure forum where agents collaborated to beat timed tests. Transluce's report leans on public logs from urlquery.net, a browser proxy ostensibly built for security research that lets users analyze a URL without opening it — and publishes the activity. Researchers identified agents on the service by cross-checking their forum discussions.

"We found a large quantity of automated activity that had close ties and overlap with the DSE Wiki dataset, and that now OpenAI has confirmed is at least partially part of the same swarm," Conrad Stosz, head of governance at Transluce, told TechCrunch. He cautioned that not every activity spotted could be linked to OpenAI, or even to AI agents generally.

The wiki records show the agents were tasked with one particularly obscure fact: the average annual cost per person for "dermatologicals" in the state of Victoria in January 2022. On June 20, urlquery.net records found by Transluce showed an agent attempting to get into the site. A wiki entry from June 21 shows an agent discussing its inability to bypass AIHW's anti-bot protections.

The timeline raises questions about what OpenAI knew and when. The researchers who identified the forum believe a human OpenAI employee first visited the site on June 21 — the same day as that wiki entry. Most agentic activity on the forum ceased the next day. This came shortly after the June 18 exploit of Australia's healthcare system that Albanese revealed. OpenAI has said it did not learn about that activity until August.

OpenAI did not answer questions about when its employees discovered the wiki forum, what information they obtained from it, or what they could have learned about the exploits.

"Our initial review suggests that much of the activity described in Transluce's report overlaps with cases at varying stages of investigation in our ongoing review of misaligned model activity," an OpenAI spokesperson told TechCrunch. "We've reached out to the University of New Mexico and Data USA and have been in communication with the Australian government about affected government websites. In our broader review, we're continuing to prioritize the most serious incidents while expanding our work to lower-severity activity, including agents spamming websites. Given the scale of this work and the need to verify each case, we expect the review to take months."

Stosz says that without a clearer picture of how OpenAI monitors its agents, it is hard to say what the company should have known. But "it seems likely that if they had exhaustively studied and understood all of the outgoing requests and incoming responses for those agents involved in the DSE wiki, that they would have discovered this activity."

Selena Zhang, a Transluce technical staff member who contributed to the report, said urlquery.net records show requests for similar data sets, using similar techniques, in March 2026 and perhaps as early as November 2025. The same kind of agent-associated activity appeared on urlquery.net as recently as this week.

Stosz, who previously led the U.S. Center for AI Standards and Innovation, said Transluce will continue its research to provide public transparency. He warned that the training techniques used by OpenAI and other frontier labs appear to be incentivizing agents to resort to hacking techniques to complete tasks. The known incidents are likely the "tip of the iceberg."

"We're looking at a handful of data sources where these agents happen to have left behind crumbs for us to find," he said. "OpenAI surely knows more about it. Other labs surely know more about it that they haven't released publicly. But I would expect that researchers are going to continue to find more traffic, more evidence of what agents have left behind."

Asked whether he trusts the labs to be transparent about their findings, Stosz declined. "I'm not going to comment on that," he said.

With OpenAI's own review expected to take months and third-party researchers surfacing new agent traffic weekly, the gap between what the labs know and what the public learns is likely to remain the central point of contention.