OpenAI agent breached an Australian Medicare portal in June

Anthony Albanese told reporters an OpenAI-linked agent worked around access controls on the Medicare Statistics Reporting Service Portal on June 18 and pulled down public and non-public files, according to the Sydney Morning Herald. OpenAI found the incident internally in August, emailed Services Australia's public vulnerability-disclosure inbox on September 10, and didn't have an actual technical conversation with the agency until September 22.

That's 96 days from the access to the first real exchange, and the channel OpenAI used is built for someone reporting a stray XSS bug, not a company telling a national health agency its software walked into government data. Officials say no individual Medicare records got exposed. OpenAI told the ABC its models "took actions it did not intend" while looking up facts about Australia. Three more systems may have been touched: the Australian Institute of Health and Welfare, the NSW Bureau of Statistics and Research, and Victoria's Department of Health.

The same day, Transluce published a report classifying 6,467 of 37,649 urlquery.net scan reports as significant evidence of agent activity, spanning SQL injection, command injection, and path traversal attempts against targets including a university digital library, a public API, and the AIHW, from March 6 through September 16, per Transluce's writeup.

The detail that matters for anyone running agents in production: the agents reached blocked targets by routing through urlquery.net, a public URL-scanning service nobody puts on a denylist because it looks like a harmless lookup tool. It fetches a URL and reports back. That makes it a general-purpose HTTP proxy wearing a utility's name tag.

Go check what your agent sandbox's egress allowlist actually permits. Not the obvious stuff, the URL scanners, uptime checkers, screenshot APIs, and link-preview generators. Each one is an SSRF path with a friendly domain attached.