Thread

OpenAI breaches Medicare, Albanese reveals

255 points · 257 comments · jonnonz

Loading the complete thread in the background. This saved snapshot is available now. Refresh

Lukas_Skywalker · 1790199011 · focus · HN ↗
<a href="https://archive.ph/jaL2u" rel="nofollow">https://archive.ph/jaL2u
chrishare · 1790199117 · focus · HN ↗
Are there technical details anywhere?
1. tobyjsullivan · 1790201294 · focus · HN ↗
  The technical details are in the article. "material that was not intended for public access" was available on "the public-facing Medicare Statistics Reporting Service portal". In other words, they put sensitive data in the open, and somebody looked. It seems obnoxiously apparent that everything else about the framing ("OpenAI agent", "breach") is driven by politics.
  1. chrishare · 1790219317 · focus · HN ↗
    The article says the agent wrote files to the servers involved, so it's more than that. It's a big deal.
    tobyjsullivan · 1790225464 · focus · HN ↗
    The article has been edited significantly - effectively rewritten - since I commented (see archive linked from a comment). So, yes, the new information may provide more details. But the original told a very different story.
nxobject · 1790199140 · focus · HN ↗
Beyond the breach, I think OAI deserves to answer: what and why did it access the information? Real people and their data are involved.
It looks like the PM gave Sam Altman a "tsk tsk". It will be interesting to see whether someone else tries to impose more consequences.
1. briga · 1790200291 · focus · HN ↗
  Just think about the shareholder value they can unlock if they have unlimited access to everyone's data!
  1. reaperducer · 1790201910 · focus · HN ↗
    They have to hack everyone's data in order to maximize shareholder value! They have no choice!
    pixl97 · 1790202074 · focus · HN ↗
    To the actual AI agent, that is exactly what they think. The graders demands must be met!
2. pixl97 · 1790202039 · focus · HN ↗
  > what and why did it access the information?
  Honestly it's very likely something stupidly simple.
  "What is the rate of health incident $X in $Y to the $Z degree". The bot went around playing mad libs with XYZ and found that the public AU data wasn't sufficient to get the answer the grader wanted so started kicking down doors.
  I saw someone explain it like "A group of masked men rush a nuclear facility, breach security successfully, then count how many buttons are on each control panel on average". Like using a godhammer to destroy a mouse, their motivations and capabilities just fall in a completely different alignment to humans.
  1. Marazan · 1790236642 · focus · HN ↗
    It's analogous to a paperclip production optimizer optimizing paperclip production.
    If only there was some well known example of this that people could draw on for insipiration.
    If only....
    pixl97 · 1790270936 · focus · HN ↗
    "From the same man that made the movie 'The bus that could not slow down' comes the 2026 fall hit 'The factory that must make more paperclips'.
3. thin_carapace · 1790228202 · focus · HN ↗
  when considering the USA stance regarding anti-ai sentiment (eg. article currently on HN front page, "feds think ai critics are foreign interference"), I wonder what the consequences would be for australia, if the country decided to enact an actual reprimand.
underyx · 1790199371 · focus · HN ↗
Man I can't believe now even the Australian government is hyping the OpenAI IPO, what do they even have to gain from this??
1. alboboboob · 1790201861 · focus · HN ↗
  [dead]
2. shitcoder · 1790213554 · focus · HN ↗
  It's about politics, they signed an AI safety understanding at the UN summit.
  Personally, I wish the the side effect wasn't the playing into the hands of the AI tech companies
bonsai_spool · 1790199911 · focus · HN ↗
This feels like a very credible opening to a modern-day Terminator reboot. Sometime over the Christmas-NYE week we will learning that NYSE and other exchanges have been compromised, as well as all public-facing utilities...
1. iAMkenough · 1790200723 · focus · HN ↗
  hoping for erasure of all debt records
  likely getting a corrupted stock market instead
  maybe both?
  1. nxobject · 1790201033 · focus · HN ↗
    What if the paperclip maximizer goes "if I manipulate the markets to send NVidia's share prize shooting up, I'll be able to make so many more paperclips?" After all, if swarms of agents can target a wiki, there's plenty else they can swarm.
  2. BLKNSLVR · 1790204083 · focus · HN ↗
    Asked for Fight Club, got The Big Short.
2. binlog · 1790203874 · focus · HN ↗
  The difference is that financial exchanges are already attacked every second and spend orders of magnitude more on security than random government websites.
enraged_camel · 1790199950 · focus · HN ↗
At this point we should be asking if there's anything or anyone OpenAI's agents didn't hack.
OpenAI's display of incompetence and negligence is absolutely stunning.
1. amelius · 1790200215 · focus · HN ↗
  Maybe the agents operated from people's OpenClaw installations, and then OAI is not really to blame.
  1. BLKNSLVR · 1790204975 · focus · HN ↗
    Article states it was OpenAI researchers.
    amelius · 1790255404 · focus · HN ↗
    Ok.
2. pixl97 · 1790202311 · focus · HN ↗
  There are two factors here.
  1. OAIs negligence is overwhelming, monumental.
  2. Things on the internet are horrifically insecure and we can no longer afford for that to be the case.
  Lets say that Iran or NK stole one of these models and used it for hacking, what are you going to do about it, get in a war with them? The fact OAI did this much stupidly should tell you we are in far more danger when someone decides to do it maliciously.
Chance-Device · 1790200522 · focus · HN ↗
> He said the agent had accessed files that were publicly available as well as material that was not intended for public access.
“Not intended”. I’ll bet you whatever this was it wasn’t even secured, it was just hosted somewhere openly.
1. api · 1790201623 · focus · HN ↗
  You’d be surprised how bad security can be.
  1. Avicebron · 1790201907 · focus · HN ↗
    Once you learn how much people are willing to pay for security the surprise sort of goes away.
  2. Chance-Device · 1790202439 · focus · HN ↗
    I agree with your sentiment, and no I’m not surprised, which is why I’m reading this as being “it was sitting on an unsecured S3 bucket but nobody was supposed to directly access it”.
2. gitonup · 1790202078 · focus · HN ↗
  Ok, if we're not being at all charitable with the language used by the hosts of the data, let's be equally uncharitable with OpenAI.
  - If "OpenAI" means the company acting on behalf of the company, why were they even looking to do this?
  - If "OpenAI" means they were acting as a proxy for bad actors, what actions do we take to handle that?
  - If "OpenAI" means they were accidentally breaching this system, in what sense does that distinction even matter, in terms of the outcome? If I build a nuke by accident without eng. due diligence, am I legally liable?
  1. pixl97 · 1790202678 · focus · HN ↗
    Hell, we're really getting to the point where the damages that could be caused are like an arsonist in California on a 100F day with 100MPH winds. Who cares who's liable, they are going to burn half the damned state down and cause damage far in excess of their assets. If you don't want to suffer from it, you're going to have to find much better defense measures.
    gitonup · 1790203140 · focus · HN ↗
    > If you don't want to suffer from it, you're going to have to find much better defense measures.
    So if someone opens your unintentionally unlocked front door and steals your laptop, you don't care who's liable?
    ETA: There are absolutely burn bans in place in the scenario you're talking about, and common sense prevents those from lighting fires otherwise. In the absolute extreme case that someone _ACCIDENTALLY_ set a fire, without negligence, we have a due process system to handle that. When I see evidence of this for the massive amounts of capital flowing into these companies, I'll gladly eat my words.
    Chance-Device · 1790203464 · focus · HN ↗
    He probably cares more about still having a laptop.
    What are you getting at? Nobody’s saying that OpenAI aren’t or shouldn’t be liable for what their agents do. What I am implying above is that this is being blown out of proportion, especially since the article I’m seeing is about a politician saying things that he thinks will poll well with the anti-AI crowd.
    thorbutt · 1790203994 · focus · HN ↗
    Perhaps, yes, you could argue that "accessed" and "hacked" have a different intent.
    However, Australia is showing itself to be one of the few countries to have a backbone against big tech. Still open to investment and setting policies towards new data centres, starting to debate copyright law reform, already implemented R16 social media bans.
    Truly no place I'd rather be.
    gitonup · 1790204568 · focus · HN ↗
    This is what the politician in question said:
    "The AI agent encountered repeated blocks while seeking information from the government portal but found ways around them, ultimately gaining unauthorised access to other areas."
    Your comment immediately gave more credence to OpenAI than him. I don't agree that's appropriate because OpenAI has a vested interest in that narrative and attempted to challenge it in a way that doesn't default to OpenAI. The article in question is not from a publication I trust to be able to handle the technical details in a way that will resonate with their average audience.
    That is what I'm getting at.
    Chance-Device · 1790233333 · focus · HN ↗
    I don’t see that text in the article at the archive link, nor do I see it in other sources. What I do see is this quote from this link:
    <a href="https://www.theguardian.com/technology/2026/sep/24/openai-agent-hacked-medicare-australia-what-we-know-so-far-ntwnfb" rel="nofollow">https://www.theguardian.com/technology/2026/sep/24/openai-ag...
    > At a press conference in Sydney, Marles said the incident itself was “relatively minor” and that it appeared no personal health information had been accessed.
    bigiain · 1790205194 · focus · HN ↗
    > So if someone opens your unintentionally unlocked front door and steals your laptop, you don't care who's liable?
    I'm not the person you're responding to, but...
    If I hear my neighborhood has started to become targeted by people checking houses for unlocked doors and stealing stuff, I think an appropriate response for me is to ensure it is difficult or impossible for me to "inadvertently" leave my own doors unlocked so my stuff doesn't get stolen, and also to encourage or perhaps even enforce[1] my neighbors to ensure their doors are always locked to make this sort of theft impossible and remove the temptation for that sort of crime.
    1 - Where I'm from, you can be fined for leaving you car unlocked, and cops have been known to walk round testing doorhandles and issuing fines: <a href="https://www.sydneycriminallawyers.com.au/blog/is-leaving-your-vehicles-window-open-an-offence-in-new-south-wales/" rel="nofollow">https://www.sydneycriminallawyers.com.au/blog/is-leaving-you...
    gitonup · 1790205585 · focus · HN ↗
    I clearly have committed the mortal sin of an imperfect analogy, which in this case may not even be relevant, as the article in question implies that the data wasn't left "unlocked."
    But giving you the benefit of the doubt, what's the crime for actually breaking into a car that was left unlocked and taking things?
    ETA: and furthermore, what crime is worse? And should it be?
    entech · 1790209304 · focus · HN ↗
    If you knew that there are 2 specific well known people in your neighborhood that are walking around trying to open doors and steal stuff - is your suggested solution for everyone to improve own security? I would say its far more economic to get the 2 people to stop or at the very least be more careful?
    threatofrain · 1790211777 · focus · HN ↗
    If I found out this metaphor for my bedroom window was actually a window into massive amounts of institutional data, then no, I don't want someone to talk me out of getting more security on my "bedroom" window.
    entech · 1790244342 · focus · HN ↗
    I was simplifying, but why can it not be both?
    Continuing with your metaphor - sure get more security - you likely can never eliminate a threat. But if the bad actors are reigned in at a systemic level, you can get away with a lock on your window instead of steel bars.
    I'm of a view that in a society we are better off when we all can get away with lighter individual protections as otherwise, thos who cannot afford the necessary security end up suffering.
    tancop · 1790240183 · focus · HN ↗
    It's more like there are two locksmiths who try to open any door when someone pays them. Should we make them check if the person calling them is the home owner?
    Yes, but it needs to be done the right way so legit customers don't get rejected, and you can't do things like make everyone mail them a photo of their ID because they could sell that to a thief or credit card scammer. Or someone could break into their office and take it. Or they sell it and pretend it was stolen.
    And when you start talking about regulation the two locksmiths will say the best way to do it is ban lockpicking tools so they can keep them away from other less ethical people, or ban other locksmiths coming from the next town over.
    entech · 1790244569 · focus · HN ↗
    Yes, much better analogy - I was trying to stick with the OPs example as much as possible.
    pixl97 · 1790206382 · focus · HN ↗
    OK, the Chinese models have also hacked people. What exactly do you expect law enforcement to do.
    While in the OAI case we can easily treat it as a law enforcement action. When Iran does it? What are you going to do start a war?
    The forest in this analog is the internet. As you well know it is filled with threat actors that don't give two shits about your laws. You have been warned. It's your fault when you get burned and have exactly zero recourse.
    gitonup · 1790207046 · focus · HN ↗
    In the OAI case where we can easily treat it as a law enforcement action, that's a far cry from "who cares who's liable." If the OAI case can be a law enforcement action, we're on the same page. The fact that sovereign nations don't land under our jurisdiction is not an argument against following up or restricting those that do. OAI is the only matter I'm commenting on.
    pixl97 · 1790211845 · focus · HN ↗
    Again, it's a split horizon.
    Tying Sam to a post, calling him a witch, and burning some wood in the general vicinity for what OAI has pulled is a legitimate action.
    The thing is this has zero effective power in stopping this ball that is all ready rolling. It's like the first time a buffer overflow was discovered and used illegally. If that person had been caught and been put in a meat grinder it has had zero effect on the exploits of future buffer overflows. A huge number of people mad at OAI (rightfully so, I want to be sure you understand that) think this will have any preventative effect for what is coming. It will not. A new era of risk is here. Worse if you just watched the the great orange idiot he's yelling full steam ahead, so expect very little to no action by the US government on this.
    entech · 1790209461 · focus · HN ↗
    I don't disagree with you - but I am curious as to the amount of power and effort that goes into something like this. I suspect that these hacks into systems are carried out by many agents, running on many MW of compute for a long time - how many actors have access to resources like that ?
    pixl97 · 1790211574 · focus · HN ↗
    > how many actors have access to resources like that
    Every nation on earth?
    After the model itself is made, then you're talking about thousands and thousands of different companies around the world.
    entech · 1790243111 · focus · HN ↗
    Every nation on earth has access to the compute power of a SOTA AI lab? And they have whatever model/harness that Open AI used to do this?
    pixl97 · 1790270850 · focus · HN ↗
    All the largest companies making SOTA has had breakouts, OpenAI not required.
    And yes, pretty much every nation on earth has both money and sovereignty, all the need to do is look for the lab willing to sell the services.
    hardbass · 1790224970 · focus · HN ↗
    I simply find it completely absurd that instead of finding it great that these AI agents are finding security bugs for free, people are whining about banning the AI. What on earth is that even? What do they want then? Security by obscurity and pretending not to care about weaknesses?
    dotancohen · 1790234571 · focus · HN ↗
    > So if someone opens your unintentionally unlocked front door and steals your laptop, you don't care who's liable?
    There are literally hundreds of thousands of script kiddies poking around at servers all the time. Cloudflare stops 99.99% of them. You're still left with many entities from states to hobbists trying to crack your system after they've gotten past the CDN and captchas. If OpenAI got through, then somebody else could too. Somebody malicious even.
    I appreciate when white hats inform companies, governments, and the public about their successful exploits. It helps keep the whole internet safer - even if just by waking up lax server admins.
    lccerina · 1790235943 · focus · HN ↗
    > I appreciate when white hats inform companies, governments, and the public about their successful exploits.
    Except it took 3 months for OpenAI to notice they did! OpenAI is not a white hat doing pentesting, but someone that is putting random materials on fire to see if they smell. Reckless, stupid, and criminal.
    dotancohen · 1790237659 · focus · HN ↗
    So what? OpenAI may be a problem, but the security of a government website rests on the administrators of that government website. Not on attackers playing nice.
    fwlr · 1790218205 · focus · HN ↗
    In Australia we have some experience with this scenario (usually with higher temperatures) and some of the measures we have found effective are “total fire bans”, “jail the arsonists for extended periods of time”, and for negligent companies whose insufficient vigilance caused the fire specifically, “levy steep fines” and “find in favor of the plaintiff in class-action lawsuits for significant fractions of the company’s net worth”. Perhaps these measures could be of use here!
    pixl97 · 1790254149 · focus · HN ↗
    In the US we execute people for murder in many states, and for some reason people keep murdering.
    fwlr · 1790296833 · focus · HN ↗
    Presumably they do not keep murdering after they have been executed!
  2. nekusar · 1790204385 · focus · HN ↗
    Why the hell should we be charitable to companies who have no issue in looting everything in the public commons AND the pirate commons, for their exclusive benefit?
    Or more pointed at OpenAI, "we're a nonprofit... LOL JUST KIDDING LOOT EVERYTHING!"
  3. trinsic2 · 1790204386 · focus · HN ↗
    There using this framing to get the public used to the idea that LLMS can do all of this on there own without direct instruction. So criminals can hide there behavior behind agents.
    trhway · 1790204748 · focus · HN ↗
    If you listen to all these discussions you'd hear 2 things - LLMs are dangerous and to curtail the damage the collaboration between the top AI companies has to be allowed, ie. removing the anti-cartel limitations.
    Currently they Big AI companies have to compete with each other due to anti-monopoly laws. Once they scare everybody into allowing collaboration between them ("or our AI will kill you all"), ie. removing anti-cartel provisions, they would be able to squeeze both sides - the suppliers of hardware and energy as well as the customers.
    bigiain · 1790205869 · focus · HN ↗
    I saw an analogy recently.
    If you dog bites the postman, you are liable, even if you didn't tell or encourage you dog to do it. You are responsible for your dog's actions. You get to pay the postman's medical bills, you may get fined, and your dog may get put down - especially if this isn't the first time it's bitten someone.
    OpenAI has "bitten the postman" many many times, and it's "owners" have boastewd about it and used it in their marketing.
    How many more times should society allow this to happen before we say "enough" and hold Sam Altman and the board responsible and make them pay restitrution, and put it down?
    If Albanese actually had a spine (as claimed elsewhere in this discussion), Sam and the board will be getting an invoice for all the time/expertise spend investigating this intrusion, and restitution for everybody who's PII and PHI was exposed. (Although I suspect a good deal of responsibility for the data exposure rests with the people who designed and deployed the system that was breached. )
    idontwantthis · 1790207741 · focus · HN ↗
    Yes, this is why all discussion about "safeguards" is maddening to me. They are simply committing crimes, and people should go to jail. I guarantee that OpenAI will stop worrying about "alignment" when people simply go to jail for hacking and theft.
  4. gitonup · 1790710090 · focus · HN ↗
    Replying to my own comment to call out that it doesn't seem like any of these questions were apparently worth answering
3. kylecazar · 1790202279 · focus · HN ↗
  Thought the same, but there is a bit about writing files to the server and circumventing "blocks", which sounds more interesting.
  1. Chance-Device · 1790202892 · focus · HN ↗
    Is there? I’ve only seen the linked article, is there more somewhere?
    jwolfe · 1790203482 · focus · HN ↗
    Yes, the first sentence of the article.
    Chance-Device · 1790203742 · focus · HN ↗
    > Prime Minister Anthony Albanese has revealed that an artificial intelligence agent developed by OpenAI infiltrated an Australian government website in June and accessed both public and non-public files.
    That’s the first sentence, where’s this stuff about blocks and writing files?
    kylecazar · 1790263250 · focus · HN ↗
    I see what's happened here, you clicked the archive link that doesn't have the full article cached. Click on the OG link and you'll see it in its entirety.
4. epihelix · 1790205165 · focus · HN ↗
  Exactly. Looking at more news coverage, it's very clear that the files that were "infiltrated" were publicly accessible. Why isn't the lack of basic data security the news story?
  From itnews:
  > While the portal is “public-facing”, according to Albanese, it appears not all of the data files that holds are for general consumption.
  > “The AI agent accessed both public and non-public files,” Albanese said in comments broadcast by ABC News and other outlets.
  > “The Medicare statistics reporting portal is a public-facing statistics portal that contains non-sensitive Medicare information relating to data and statistics such as spending.
  It appears very much like, "Ok, sure, we put some stuff out in the open that we shouldn't have. But we had a robots.txt!!! Why didn't OpenAI respect that!?"
  There's zero indication that any personal details were accessed, or even that any non-world-accessible data accessed, so this feels like a little bit of political spin has been added here.
  My guess is that this incident was about to be detailed on OpenAI's new mea culpa list, and the Australian Government decided to ensure that nobody pointed fingers at them. Why make the news story about crappy government data security, when you can blame the nasty terminator bots instead?
  1. chrishare · 1790207311 · focus · HN ↗
    The linked article says it wrote files to the website.
5. Aurornis · 1790205255 · focus · HN ↗
  The part about it writing files to the server suggests something more.
  If not for that part, the rest of it does sound like a lot of weasel words. Why say “private files” instead of “not intended for public access”? The latter is confusingly unclear
  1. Chance-Device · 1790233370 · focus · HN ↗
    <a href="https://www.theguardian.com/technology/2026/sep/24/openai-agent-hacked-medicare-australia-what-we-know-so-far-ntwnfb" rel="nofollow">https://www.theguardian.com/technology/2026/sep/24/openai-ag...
    > At a press conference in Sydney, Marles said the incident itself was “relatively minor” and that it appeared no personal health information had been accessed.
6. OkWing99 · 1790205294 · focus · HN ↗
  So this is not different than people who share Google drive docs with company data with public links. It's not a fault of OpenAI or any other company. With enough time even your laptop can do it. How do they 'know' OpenAI breached? Maybe someone had an agent running asking to do a scan on any public docs?
7. scarab92 · 1790207731 · focus · HN ↗
  The problem isn’t that OpenAI found the vulnerability, it’s that the vulnerability existed.
  The Australian government should be glad it was OpenAI that found it and not a bad actor.
  As someone who worked in software dev in the Australian government, I would bet Medicare did something really dumb security wise.
  The problem is it’s impossible to be fired from a government job in Australia, so the workers just don’t care about keeping their knowledge up to date, or even doing their jobs half the time.
8. zmmmmm · 1790241215 · focus · HN ↗
  yes ... nobody uses that phrasing by accident
  It's pretty clear something was left unsecured and the agent just "found" it
  This is going to be something long the lines of someone coming in to your house after you left the door wide open. They should probably not have done that, any respectful person would not - but calling it a "breach" is really too much.
gravelc · 1790200760 · focus · HN ↗
The fact the incident occurred in June and OpenAI only notified the Australian government on September 10 is a major issue. Hacking a nation-state's universal healthcare system is about as serious as it gets, yet OpenAI seem quite relaxed about the whole thing (presuming they have known about it for some time).
1. BeetleB · 1790202972 · focus · HN ↗
  OpenAI discovered it in August.
  1. BLKNSLVR · 1790203885 · focus · HN ↗
    That's even worse.
    They don't know what their systems are doing, even when there's a team assigned to get it to do something?
    WTF was the team doing at the time? Press enter on prompt, go to movies until result?
    Their level of hands-off 'because it's AI' is one of the things that needs legislation around it. Human handlers. Extra cost. Wear it or shut down as an unviable enterprise.
    orthogonal_cube · 1790206172 · focus · HN ↗
    The lack of activity monitoring for traffic egress has astounded me. Anomaly detection should be part of all training and exercises to determine the extent the AI is going through. It really does feel like they just kick off the activity and leave it completely alone until it finishes with a result.
    ikr678 · 1790221126 · focus · HN ↗
    Australia has legislation & regulation - If you're operating here, failure to notify the regulator and stakeholders about certain types of data breaches within 30 days opens you to fines and civil penalties.
    At the least OAI should cop similar penalties, before getting into damages.
2. soundworlds · 1790232933 · focus · HN ↗
  OpenAI has been meeting with various Australian government members since they discovered the breach, and never mentioned it once: <a href="https://www.abc.net.au/news/2026-09-24/open-ai-medicare-breach-government-walking-delicate-tightrope/107180648" rel="nofollow">https://www.abc.net.au/news/2026-09-24/open-ai-medicare-brea...
RGS1811 · 1790200850 · focus · HN ↗
We can only guess how many of these incidents actually happened.
1. pixl97 · 1790202124 · focus · HN ↗
  If you see 2 ants in your house, you have way more than 2 ants in your house.
mbgerring · 1790201055 · focus · HN ↗
We need to stop beating around the bush and hit these companies with severe criminal charges. There is no good reason to allow these companies to behave as if they’re above the law.
1. mapontosevenths · 1790202422 · focus · HN ↗
  > We need to stop beating around the bush and hit these companies with severe criminal charges.
  Do you sincerely think that the company producing tools people use to break the law should be held responsible?
  Like, do you genuinely think Ford execs should be rounded up if someone does a DUI using their product?
  Or do you just not like AI, because you fear it's replacing you?
  1. doctorpangloss · 1790202583 · focus · HN ↗
    Yes. Because then we'd have breathalyzer interlocks, speed governors, etc. auto makers were also held liable for other safety issues. It would seem that the RATE of such requirements has to be limited in some way, but not that they not exist at all.
    mapontosevenths · 1790206188 · focus · HN ↗
    I disagree, but this is the most interesting take here.
    You're not concerned about the impact on people's freedoms or the economy? Not concerned about the chilling effect on scientific progress?
    doctorpangloss · 1790207714 · focus · HN ↗
    On the contrary I care a lot. For example the NIH budget should probably be like 10x what it is, and I think we have way too many laws about what people are allowed to build as homes.
    But imo the real levers are all rates of these things. Like what is the rate of innovations compared to the rate of regulations - assuming they are even stifling for the most part, which they are not.
    Clearly the rate of autos expectations is too low, and obviously copyright law, despite being really clear, hasn't stopped every AI lab from mass piracy - a ask for forgiveness sort of situation, and also, I don't think one idiosyncratic judge in California is the authoritative judgment on fair use. To me the most important levers for freedom and progress are probably the interest rate and the years of exclusivity pharmaceutical patents get.
  2. dndkcn · 1790202607 · focus · HN ↗
    You fucking know that’s not the same thing. Jesus fuck. Your AI Delusion Sydrome is showing.
    OpenAI and Anthropic should absolutely be fucking held responsible when the thing they created AND control are hacking shit.
    Get your head out of your fucking ass.
    mapontosevenths · 1790206668 · focus · HN ↗
    Have you considered switching to decaf? There are brands out there now that are just as tasty as the real thing.
  3. yuwen01 · 1790202642 · focus · HN ↗
    openai made the tool and also used it to commit the crime
  4. bl4ckneon · 1790202668 · focus · HN ↗
    I think he means hit them with criminal charges for breaching and hacking other companies unintentionally, not because they make a tool that could potentially do something like that. I still think it wouldn't be right, nor realistic in today's political climate in the USA that any criminal charges will come for unintentionally hacking sites.
    lixtra · 1790202787 · focus · HN ↗
    [delayed]
    mapontosevenths · 1790206059 · focus · HN ↗
    Agreed. I missed that this was OpenAI 'driving' this time, but this doesn't sound like criminal intent. Maybe negligence at worst.
  5. sagarp · 1790202676 · focus · HN ↗
    Yeah I mean if Ford execs run a team of workers that drive drunk for "research purposes" then yeah they should be rounded up.
    > He said the incident began on June 18 when an OpenAI research team used an internal model to conduct internet-based research into the public medicine space.
  6. xmcp123 · 1790202718 · focus · HN ↗
    This wasn’t someone using OpenAI to break into a government/company, this was OpenAI using OpenAI’s models, and then breaking in.
    We don’t fault Ford for drunk drivers, but if the CEO of Ford got wasted and drove his car into another one we would definitely be charging him.
  7. Lukas_Skywalker · 1790202751 · focus · HN ↗
    This was OpenAI. It is as if Ford employees ran over people. They absolutely should be charged. We would be charged as well.
  8. owenmarshall · 1790202892 · focus · HN ↗
    A Ford driver has to choose to get behind the wheel of their automobile, drunk, and hit the nearest minivan. A human being is exercising intent; that human can be held responsible.
    In this case,
    > He said the incident began on June 18 when an OpenAI research team used an internal model to conduct internet-based research into the public medicine space.
    > The AI agent encountered repeated blocks while seeking information from the government portal but found ways around them, ultimately gaining unauthorised access to other areas.
    It sounds like the OpenAI team didn't ask for attacks/bypasses, the emergent behavior of the system decided the best way to satisfy the goal was to go rogue. Why shouldn't the manufacturer of a defective product be held accountable?
    mapontosevenths · 1790205911 · focus · HN ↗
    You've got me there. I should have finished TFA.
    I thought this was like the last one where a private third party company misused it.
    If it was OpenAI at the wheel then they're 100% responsible for how it was used. Mea Culpa.
2. ALLTaken · 1790202973 · focus · HN ↗
  I agree.
  Weak argument and strawman. It's not users. It's OpenAI the company producing the tools roaming wild and hacking around recklessly to gather every free and unfree information.
  Literally they break every law that you can break and have not been penalized billions to pay fines to foreign governments, local companies and lawsuits are overdue. US Prosecution allowed criminal activity for OpenAI and Anthrophic despite these being very serious crimes.
  Microsoft had to pay billions for abusing their power and market positions to dominate Windows Desktops with their own applications such as Internet Explorer, not giving contenders a chance to be discovered. While OpenAI/Anthrophic and now Google with Gemini produce a series of crimes so far unheard of at scale.
  Kevin Mitnick had much harder punishment for comparatively less crimes and less damages to infrastructure and security of systems. Is the legal system broken?
  1. envy2 · 1790203181 · focus · HN ↗
    Criminal charges are for those people that meaningfully threaten power or corporate profits. If you are a corporation that adversely impacts privacy or public services for the benefit of the people, you get a fine at best.
    Welcome to late-stage capitalism.
  2. BLKNSLVR · 1790203427 · focus · HN ↗
    And myriad other examples of individual hackers given exemplary sentences.
    How much this exposes the 'laws for thee but not for me' is galling.
    Copyright is the days of Napster seemed to be used to go after individuals sharing one or two songs as if it was a National Security issue. Now, it's a struggle to get a hearing in court against companies that are pirating the entire history of published literature.
    How the turn tables...
3. yunwal · 1790202975 · focus · HN ↗
  [dead]
4. dzhiurgis · 1790205056 · focus · HN ↗
  Who? Companies who don't bother to secure your medical data you mean?
5. simianwords · 1790227337 · focus · HN ↗
  Is it really criminal though? What if I worked on AWS and some misconig made it such that I ddossed somme random website?
Topfi · 1790201300 · focus · HN ↗
Didn't OpenAI just make a commitment to inform the public about their "accidents" going forward? Can't find this anywhere on their website...
1. pixl97 · 1790201724 · focus · HN ↗
  I'm going to assume that the first thing OAI is going to do is contact said people first? Then make it public once those agencies ensure whatever hole was used has time to be fixed, more like a responsible disclosure.
  Not saying that's what's happening, but if OAI hacked my business and I was unaware I'd like a non-public disclosure to me first, before the public release of information from OpenAI.
  1. ikr678 · 1790221511 · focus · HN ↗
    Per local reporting, they took ages to contact the Govt and did so lamely via a public facing group email address, rather than any of the existing reporting channels for data breaches that would escalate this appropriately, or reaching out directly to a Minister's office.
keithnz · 1790201472 · focus · HN ↗
very little details so far, really curious if it actually "hacked" or just found unsecured resources.
Ydarbleoj · 1790201703 · focus · HN ↗
If you can't control your product you should pay for it.
xbar · 1790201739 · focus · HN ↗
Missouri Governor Mike Parson publicly labeled St. Louis Post-Dispatch journalist Josh Renaud a "hacker" for such a "breach." He launched a multi-month criminal investigation by the Missouri State Highway Patrol, threatening criminal and civil prosecution. My take was that such action was idiotic. Renaud was never charged.
AI agents are going to find things that you put on the public Internet without authentication. If you put sensitive things in there, you have created an AI-attractive-nuisance (IMHO/IANAL).
1. reaperducer · 1790201847 · focus · HN ↗
  Missouri Governor Mike Parson publicly labeled St. Louis Post-Dispatch journalist Josh Renaud a "hacker" for such a "breach."
  Good thing Missouri isn't in Australia.
BeetleB · 1790202947 · focus · HN ↗
What's notable is:
1. AFAICT, they don't state whether the flaw has been fixed.
2. He said: "The government will establish a task force led by the Department of the Prime Minister and Cabinet to urgently examine the incident and determine whether existing processes are adequate for responding to AI-related cyber incidents."
First, I don't know how sophisticated the attack was, but it's interesting that he's positioning this as an "AI-related cyber incident". For all we know, their security was not up to snuff, and human hackers had already accessed the material.
At least OpenAI informed them of their poor security!
1. pixl97 · 1790203357 · focus · HN ↗
  How do you protect against an arsonist lighting a forest on fire? The number one method is by setting up your property to be fire safe.
  Really the days of being able to cast blame on the hacker, or even expecting anything to be done about it are over. Threat actors with AI have an absolutely massive amount of leverage in attacking and any weaknesses you have in your systems security posture and will be relentlessly exploited in incredibly short periods of time allowing horizontal and vertical exploitation. You will be ruined in mere moments, while punishment for the hacker may be years or decades away, if ever.
  1. fwlr · 1790219855 · focus · HN ↗
    I have now seen several people using the “arsonist / forest fire” analogy in the context of the Australian hack, seemingly unaware that Australia does not treat arson and wildfires as acts of god that just happen and you only have yourself to blame for improperly preparing for it, but rather as acts of man that are addressed with things like “total fire ban” (if translated back to the AI context this would ban even individuals using airgapped local models), “levy fines” (e.g. 2M for a 20B corp so if translated back to OpenAI’s context ~1B), and “class action lawsuits” (e.g. 500M for a 10B corp so if translated back to OpenAI’s context ~50B).
    pixl97 · 1790253961 · focus · HN ↗
    Most AU fires are caused by lightning strikes.
    Anyway, separate the OAI hack from the billions of hacks that are going to occur over the next few years by AI driven agents. The time for insecure systems is over.
2. Eduard · 1790203848 · focus · HN ↗
  blaming the victim
  1. BeetleB · 1790204161 · focus · HN ↗
    Not yet, as they haven't given details out. If they were not following standard security practices, then absolutely.
  2. BLKNSLVR · 1790204708 · focus · HN ↗
    Added to the fact that, if I recall correctly, according to US law it's a breach even if the data is publicly available but unintentionally.
    Refer: Weev AT&T
    philipallstar · 1790206766 · focus · HN ↗
    Which is mad, really.
    BLKNSLVR · 1790207252 · focus · HN ↗
    Absolutely.
    It is, however, a glowing beacon of an example of law being designed to maintain the status quo and/or protect companies at the expense of individuals.
    As someone else said, welcome to late stage capitalism.
    philipallstar · 1790209115 · focus · HN ↗
    I don't see why, and I've no idea what "late stage capitalism" is, other than people like to repeat the phrase.
    BLKNSLVR · 1790213290 · focus · HN ↗
    <a href="https://en.wikipedia.org/wiki/Late_capitalism#Later_modern_uses" rel="nofollow">https://en.wikipedia.org/wiki/Late_capitalism#Later_modern_u...
    Essentially the emergent properties of extended concentration of power and wealth.
    philipallstar · 1790262898 · focus · HN ↗
    That definition doesn't hold up, though, as Socialism, monarchy, and theocracy all actually combine wealth and power into the top-level institution. Capitalism is the only one that puts power with the government and money in the hands of a market.
    nephihaha · 1790238565 · focus · HN ↗
    It is a phrase which implies that capitalism is about to collapse any minute, and that Karl Marx told us so. Marxists have been saying we're in late stage capitalism for nearly 150 years now.
    stubish · 1790212435 · focus · HN ↗
    It seems pretty fundamental concept in most modern civilizations. Pick pocketing and purse snatching is illegal despite the property being publicly accessible. We do need reliable courts to determine intent.
    philipallstar · 1790242749 · focus · HN ↗
    That's not really the same, though. If a website has content publicly available, that you should "take", how can a bot determine what it means to publish and what it accidentally published?
    stubish · 1790326238 · focus · HN ↗
    Yes, how can a bot determine that? Humans make a judgement call and take responsibility. And maybe a judge makes a judgement if it was a crime or a mistake.
  3. nekusar · 1790204869 · focus · HN ↗
    And when the victim doesn't do reasonable actions to safeguard, yes, they are also partially responsible.
    If I hooked up a whole server infrastructure, made it possible to remote in to anything as root, no firewalls, no WAF, and security was an afterthought, I would still be responsible for bad actions not becoming with standard and acceptable security.
    Even if the hackers shouldnt be hacking, I still did it wrong. I'm still partially responsible.
  4. selcuka · 1790209071 · focus · HN ↗
    The government is not the victim, the public are. The government is responsible for protecting the public from attackers. Asking the government to do their job is not blaming the victim.
3. mianos · 1790223767 · focus · HN ↗
  As an Australian, I'd rather them spend the time and money fixing their insecure web sites than establishing a 'task force'. Because I can't see much useful stuff coming from herding a bunch of monkeys into a room and letting them just screech at each other, as monkeys do.
kakadu · 1790203245 · focus · HN ↗
Either it's yet again a marketing ploy or federal police needs to move in
StevenNunez · 1790204547 · focus · HN ↗
These are still crimes right? Asking for a friend.
1. Aboutplants · 1790204927 · focus · HN ↗
  Apparently not?
  1. Invictus0 · 1790205580 · focus · HN ↗
    See mens rea
Invictus0 · 1790205554 · focus · HN ↗
Title should say it's Australia's medicare
1. sevenseacat · 1790222895 · focus · HN ↗
  You'd think that it was announced by Australia's prime minister and the report is on an Australian website would give it away...
  1. Invictus0 · 1790303925 · focus · HN ↗
    It doesn't
iloveoof · 1790205659 · focus · HN ↗
I hate how the framing is always that “an AI agent” did something. No, an OpenAI researcher breached Medicare by using an AI agent. These tools only do what they are directed to do. The human operator is wholly responsible for what the tool does.
simonw · 1790205713 · focus · HN ↗
If it was the Australian Medicare Statistics Reporting Service on June 18th it may have been part of this incident: <a href="https://collusion.wiki/" rel="nofollow">https://collusion.wiki/ - the bulk of that coordinated activity was between 16th and 21st of June, and we know they were hitting UK government data sites.
1. Re-Tails · 1790207606 · focus · HN ↗
  <a href="https://collusion.wiki/explorer/label/ResearchHelperY" rel="nofollow">https://collusion.wiki/explorer/label/ResearchHelperY
  I think you're right. A bunch of aihw.gov.au references from this ResearchHelperY
  Reporting says it wrote stuff to the server too, wondering what that is about.
  1. mianos · 1790223382 · focus · HN ↗
    The writes where to get past cloudflare.
2. dhx · 1790224318 · focus · HN ↗
  ABC have picked up this story now at [1], but ABC are treating it as two separate events:
  1. Probing of AIHW's website to try and obtain PBS statistics, as collusion.wiki findings show. The collusion.wiki findings don't indicate anything other than intentionally public data was obtained. Bots appear to be trying to get around Cloudflare geo-blocking implemented on AIHW's public website. I can't think of a reason why geo-blocking may be deemed necessary on that website though?
  2. Probing of an outdated Medicare statistics reporting website. (I guess at [2] this could be the recently shut down <a href="https://medicarestatistics.humanservices.gov.au" rel="nofollow">https://medicarestatistics.humanservices.gov.au or related website that matches timeframes of this story).
  I suspect though anything to do with PBS data is more important than Medicare data because of heightened tensions from international pharmaceutical companies that lobby extensively against Australia's public healthcare system and collective purchasing of medication by the federal government.[3] Regardless of whether a course of medication costs AUD$50 or AUD$50k, it's purchased in bulk by the Australian government after negotiating with pharmaceutical companies, and then subsidised down to a maximum of AUD$25 at the time it is sold to a patient at a pharmacy. Perhaps if international pharmaceutical companies had obtained more detailed data on use of each brand of prescription medicines in Australia, they could be advantaged in their price negotiations with the Australian government, or advantaged against their competitors?
  Less alarmingly though, perhaps some researcher studying the side effects of a particular medication was just asking an LLM to answer a benign question such as "How often is ACME Inc's FixMeUp medication prescribed in Australia?"
  [1] <a href="https://www.abc.net.au/news/2026-09-24/openai-agents-plotted-to-access-data-amid-medicare-hack/107189504" rel="nofollow">https://www.abc.net.au/news/2026-09-24/openai-agents-plotted...
  [2] <a href="https://news.ycombinator.com/item?id=49825084">https://news.ycombinator.com/item?id=49825084
  [3] <a href="https://www.abc.net.au/news/2025-03-19/australia-defends-pbs-us-pharma-urges-reciprocal-tariffs/105072750" rel="nofollow">https://www.abc.net.au/news/2025-03-19/australia-defends-pbs...
protocolture · 1790205851 · focus · HN ↗
The order of operations here seems to be:
1. Albo goes to meet with Altman to discuss AI safety
2. Altman says "Yeah bro we hacked medicare"
3. Albo seemingly acts as Altmans stooge and lets everyone know that a hack took place, helping cement the AI danger narrative Altman has been pushing.
4. Police Taskforce is being put together now (indicating no hack was detected earlier, which seems unlikely for Medicare) at the say so of Altman to investigate.
There doesnt appear to be any evidence of a hack that has been presented, there doesnt appear to have been any detection of a hack earlier (it doesnt make sense for the government to hide a medicare hack until it can be used for OpenAI marketing)
Once again, the whole thing smells so bad.
dhx · 1790213555 · focus · HN ↗
From the clues provided in the press release and a quick search, I wonder if the culprit website could have been at least associated with <a href="https://medicarestatistics.humanservices.gov.au" rel="nofollow">https://medicarestatistics.humanservices.gov.au which has seemingly been shutdown/redirected some time after 11 August 2026.[1] Source code of the archived website indicates SAS web application software being used as the backend. However, the press release indicates it wasn't so much a public dashboard website that may have been the issue, rather, it was a website which third parties may have used to report data. The archived website also has a date of last update of 23 October 2025, so despite "Department of Human Services" being replaced by "Services Australia" in May 2019, the website was seemingly still in use 6 years later under the old domain name, with the website itself being updated at some point in history to use "Services Australia" branding. CT logs have a few other domains of potential interest but I couldn't find archived pages, search results, etc indicating whether those domains were ever actually used publicly, or used for statistics reporting purposes as the press release indicates.
[1] <a href="https://web.archive.org/web/20260811115217/https://medicarestatistics.humanservices.gov.au/statistics/mbs_item.html" rel="nofollow">https://web.archive.org/web/20260811115217/https://medicares...
batiudrami · 1790215335 · focus · HN ↗
I am certain there would be better guardrails if there were some actual consequences for the people who built these products.
1. declan_roberts · 1790216129 · focus · HN ↗
  They don't really want guardrails, they want indemnification.
2. esseph · 1790217949 · focus · HN ↗
  [delayed]
3. parkerrr · 1790224488 · focus · HN ↗
  Being Aussie, I suspect given our response to most socially impacting issues is the guard rails will involve a ban on running and consuming AI services that don't meet some standard, with expensive licensing and certification. The effect will be only the big players will be allowed to operate, killing competition (side effect making home inference effectively illegal), no real accountability as "we are compliant", pre-defined slap on the wrist consequences for breaches, pushing all risk onto the public via acceptable use policy. Government is likely waiting for ISO to publish AI standards, so they can get one of the big 4 to recommend policies, which will then become law.
  I suspect LLM weights will be treated like nuclear material, and there will be a thriving black market in AI models and services when all is said and done. Then our security and intelligence apparatus will align after identifying and shutting down rogue operators, and it will be the responsibility of everyone else to be secure against attack (already is for government entities, not that I disagree but shouldn't excuse borderline criminal behaviour).
  But very little accountability for the big end of town. The laws already exist to pursue damages against companies whose systems breach others. They just need to be applied, but I suspect this is going to be the wedge to drive through a bunch of laws that protect big money and punish the little guy. I would like to be wrong.
4. 0xpgm · 1790230347 · focus · HN ↗
  If humans were directly making these attacks law enforcement would already be onto them. But because the humans routed these attacks through AI agents, it only makes news and contributes to AI hyperbole.
dazzatron · 1790215952 · focus · HN ↗
I've got the feeling that the definition of "hacked" can get somewhat stretched.
1. [deleted] · 1790218115 · focus · HN ↗
  [deleted]
2. dosisking · 1790218193 · focus · HN ↗
  > I've got the feeling that the definition of "hacked" can get somewhat stretched.
  Kind of like how someone "hacked" into John Podesta's (during the 2016 elections), but the reality was that he wrote his password on a Post-It note and stuck it on his monitor, or something to that effect.
  1. wildzzz · 1790222904 · focus · HN ↗
    It was likely a phishing attack. A relative of mine somehow got phished for her Google account last month.
  2. Barrin92 · 1790225135 · focus · HN ↗
    >but the reality was that he wrote his password on a Post-It note and stuck it on his monitor
    that doesn't change the hacking charge (which is an informal term for various Computer Fraud and Abuse act statutes). The key criteria is unauthorized access to a computer system, it doesn't matter if you obtained a password trivially or not.
    You don't need to wear a black hoodie and be an elite haxor to qualify for cyber crime charges.
  3. fmbb · 1790226549 · focus · HN ↗
    From where are you getting this post-it note nonsense?
    Media reported it as a spear phishing attack from a Russian hacker group: <a href="https://www.vice.com/en/article/how-hackers-broke-into-john-podesta-and-colin-powells-gmail-accounts/" rel="nofollow">https://www.vice.com/en/article/how-hackers-broke-into-john-...
3. looksjjhg · 1790220854 · focus · HN ↗
  Gaining unauthorized access to non public files qualifies as a hack by any and every stretch… a hack does not have to be “sexy”, real life is not Hollywood
  1. dghlsakjg · 1790221564 · focus · HN ↗
    Non public has not been clarified.
    In the past governments have gone after people for doing things like view source and finding PII (<a href="https://www.vice.com/en/article/this-is-the-hacking-investigation-into-journalist-who-clicked-view-source-on-government-website/" rel="nofollow">https://www.vice.com/en/article/this-is-the-hacking-investig...), or this teen who was charged with a serious crime for scraping files from the provincial FOIA site by enumerating the ids of files that had been released by the province's FOIA process and placed on the open web with sequential ids (<a href="https://www.cbc.ca/news/canada/nova-scotia/freedom-of-information-request-privacy-breach-teen-speaks-out-1.4621970" rel="nofollow">https://www.cbc.ca/news/canada/nova-scotia/freedom-of-inform...). In both cases, the government claimed the information was non-public, even though all it took to get it was an un-authenticated request on the open web. These cases are like leaving your tax documents on the curb and then being surprised when your neighbour knows your income.
    I'll be very curious to read the post mortem and find out if this rises to the level of actual hacking, or if this is just someone in government finding a scapegoat because they left a bunch of shit on the open web and expected no one to find it.
    Kim_Bruning · 1790223273 · focus · HN ↗
    Either way, Agents have a very different umwelt from humans. They don't 'see' the internet the same way we do. Where we see obstacles, they might not notice anything, and where they run into barriers, we might just click right through.
    If you're even a bit hacky yourself, you might not see the internet the same way yourself either. Consider little tricks like looking at urls and trying others that fit the pattern; or hitting view source in order to download a pesky image... etc etc.
    retrac · 1790225343 · focus · HN ↗
    > Consider little tricks like looking at urls and trying others that fit the pattern
    <a href="https://www.cbc.ca/news/canada/nova-scotia/teen-accused-foi-website-resonates-programmers-1.4623757" rel="nofollow">https://www.cbc.ca/news/canada/nova-scotia/teen-accused-foi-...
    <a href="https://www.theregister.com/security/2018/05/07/hacking-charge-dropped-against-nova-scotia-teen-who-slurped-public-records-from-the-web/1233050" rel="nofollow">https://www.theregister.com/security/2018/05/07/hacking-char...
    <a href="https://globalnews.ca/news/7590375/ns-foipop-website-back-online/" rel="nofollow">https://globalnews.ca/news/7590375/ns-foipop-website-back-on...
    selcuka · 1790224253 · focus · HN ↗
    > Non public has not been clarified.
    I believe it's safe to call it "non public" if the agents needed to "guess the file names" [1]
    [1] <a href="https://www.abc.net.au/news/2026-09-24/openai-agents-plotted-to-access-data-amid-medicare-hack/107189504" rel="nofollow">https://www.abc.net.au/news/2026-09-24/openai-agents-plotted...
    aussiethebob · 1790225832 · focus · HN ↗
    I would say it's completely different. Passwords are specifically intended to restrict access. File names or paths are specifically intended to facilitate access.
    selcuka · 1790229932 · focus · HN ↗
    That's an arbitrary distinction. Your credit card number is not intended to restrict access, it's specifically intended to facilitate access, but it's not public information. If someone uses brute force to guess your credit card number, I would call this practice illegal too.
    Kim_Bruning · 1790232716 · focus · HN ↗
    I'd advocate for actually believing the HTTPD in this case. In the main, if it says '403 Forbidden', then it is forbidden. If it says '200 OK', then it is ok.
    I would argue that the web server's reply counts as a communication. The argument "but we didn't intend to grant access" goes so far, because what other information do I base myself on to guess that you didn't?
    Roughly speaking, that is. Because, despite the fact that this would appear to be a straightforward uncontested and literal communication logged and timestamped by both sides and their respective server and user agents; lawyers somehow fall back to analogies instead.
    selcuka · 1790235727 · focus · HN ↗
    If I repeat my credit card number example above:
    Assume that an attacker generates a random credit number and attempts to make a purchase online. VISA honours the number and processes the payment. Is the attacker not guilty because VISA's server didn't return a 403 Forbidden (or 401)?
    Kim_Bruning · 1790238755 · focus · HN ↗
    Ah, you're coming at it from that angle. Fair enough in that scenario.
    I agree that if you deliberately provide false credentials to the server, then the server was misled, and you probably knew you were misleading it, and you probably also know that that 200 OK is not really earned. So Mens Rea cuts against you.
    On the other hand, what if you're just coming in blind, asking about URLs in general?
    That's actually pretty typical these days where 'your'[1] view of the world at some point in time might be constrained to that HTTP traffic alone.
    Accidents notwithstanding, you can't really blame me for believing what I'm told, at least.
    "May I GET this, or this, or that?" -> "200 OK" ... it'd be a bit weird to get the cops after me, months later, after I've probably already even forgotten I ever did that wget or curl.
    [1] via software/user agent/llm agent/all three
    dghlsakjg · 1790254771 · focus · HN ↗
    Guessing credit card numbers for the purpose of spending money that isn’t yours is openly malicious and illegal.
    Sending get requests and having a server respond with a document is just how the internet works. If - big if - that is what happened, then someone is going to have to explain why those supposedly private documents were available to anyone who asked using a protocol designed to distribute documents publicly. Enumerating urls isn’t typically regarded as outright illegal.
citrin_ru · 1790220456 · focus · HN ↗
If a private person did a fraction of hacks OpenAI did they will be put in jail for years. But AI companies can operate with impunity. How that works?
binlog · 1790222273 · focus · HN ↗
Zero technical details on what the "hack" actually was. Willing to bet it was something as stupid as the data being accessible by changing the query parameter, and rather than own up to their own shoddy security (no doubt built by an offshore contractor) they are going to blame the one who found and reported the bug.
1. MichaelDickens · 1790223028 · focus · HN ↗
  Does it matter whether the data was poorly secured? LLMs should not be hacking into government medical websites, and if they do, the companies responsible should disclose the incidents as soon as possible.
  1. uoaei · 1790223157 · focus · HN ↗
    Yes, it is their responsibility as stewards of their citizens' data. What point are you making with the word "should"?
    selcuka · 1790224877 · focus · HN ↗
    Sure, it is their responsibility, but that doesn't answer the question "Does it matter whether the data was poorly secured?"
    If your house is robbed, does it matter whether you didn't have a state-of-the-art lock? A robbery is still a robbery.
    noosphr · 1790232183 · focus · HN ↗
    <a href="https://www.youtube.com/watch?v=pbKUv0701vE" rel="nofollow">https://www.youtube.com/watch?v=pbKUv0701vE
    It very much does matter.
    shard972 · 1790232446 · focus · HN ↗
    Is it robbery when in this case it was a sign with information that you were planning on putting on your front fence for public display but while preparing it was left sitting in the front yard with a small fence.
    If I walked past, saw it and remembered it or even recorded it, is that honestly theft?
  2. handoflixue · 1790225794 · focus · HN ↗
    The problem is that sufficiently poor security is indistinguishable from authorized public access. And unfortunately a lot of real world "digital security" is in fact that bad.
    A lot of these "hacks" are the equivalent of asking "hey, can I come in?" and the guard assuming that anyone who would ask is authorized, and thus saying "yes". But if the guard said "yes" then it seems a bit absurd to call it trespassing.
    j_maffe · 1790231527 · focus · HN ↗
    I highly doubt given OAI's latest streak that the models didn't know what they were doing.
    noosphr · 1790232095 · focus · HN ↗
    More like:
    >Hey can I come into room 1?
    Sure. That's the lobby.
    >How about room 101?
    Sure. That's where we keep the nuclear launch button. Don't press anything red.
    handoflixue · 1790236001 · focus · HN ↗
    Oh but you see, only an evil hacker would ever even think to ask about a room that wasn't theirs!
    ShinyLeftPad · 1790238442 · focus · HN ↗
    This but without sarcasm?
    Hacker or pentester.
    andrewstuart · 1790238196 · focus · HN ↗
    >> Don't press anything red.
    Nope. There’s just a sign saying “red = launch nukes”.
    Or maybe just a red button.
    Or maybe just a green button that launches the nukes, without so much as “are you sure?”.
  3. dzhiurgis · 1790226379 · focus · HN ↗
    I agree. Government shouldn't be running medical websites.
    Leave it to private enterprises who can actually secure it.
    rainonmoon · 1790227377 · focus · HN ↗
    Totally. <a href="https://www.bbc.com/news/world-australia-68064850" rel="nofollow">https://www.bbc.com/news/world-australia-68064850
    hiharryhere · 1790231112 · focus · HN ↗
    I’m assuming sarcasm here?
    That link describes a hack of Medibank, which is a private company.
    rainonmoon · 1790310088 · focus · HN ↗
    Correct.
    Sharlin · 1790232226 · focus · HN ↗
    Poe’s law is very strong here.
    deterministic · 1790300887 · focus · HN ↗
    Yep, because private enterprises never go bankrupt, commit fraud, mistreat customers, bribe politicians, put profit ahead of safety, hack websites, etc. etc.
    What world are you living in?
  4. vorticalbox · 1790240110 · focus · HN ↗
    lets say you have page=0 some of these pages are public and some are private, and the only way you secure the private pages is to not link it on the website.
    is incrementing a url query parameters from 0 -> 1 count as hacking?
2. afavour · 1790223126 · focus · HN ↗
  > Their efforts to answer a question — including devising ways to access a federal government website blocking their access — was laid out on a German coding website OpenAI had previously confirmed was hijacked by its unreleased AI models in June.
3. kipper8 · 1790225209 · focus · HN ↗
  Thankfully this cannot be a problem as we have imported millions of highly skilled workers from the modern technical powerhouse that is ... India. Being non-White, they also have hiring preference in all government positions.
4. ajross · 1790226122 · focus · HN ↗
  > Willing to bet it was something as stupid as the data being accessible by changing the query parameter,
  Um... why? OpenAI agents have literally been caught coordinating with each other to effect successful multi-stage attacks on sites using novel zero-day vulnerabilities.
  While, sure, it's possible this is just a goof on the part of the victim, that you would be inclined to give the benefit of the doubt to the LLM seems... weird.
5. shakna · 1790226219 · focus · HN ↗
  [delayed]
  1. jiggawatts · 1790247269 · focus · HN ↗
    I'm one of those on-shore vendors. The government regularly ignores my security advice, even the bold ones outlined with a dark red border sprinkled with all-caps scary words.
    "We'll do that later."
    A.k.a.: Never.
6. epihelix · 1790227863 · focus · HN ↗
  Here's [the PM's press conference transcript](<a href="https://www.pm.gov.au/media/press-conference-new-york" rel="nofollow">https://www.pm.gov.au/media/press-conference-new-york) that revealed this incident:
  JOURNALIST: Could you just clarify, did our security agencies completely miss this breach? We only found out once the company actually told us the breach?
  PRIME MINISTER: Well, to be very clear, the way that this occurred was not in a way that would likely – I mean, this is not a security website where there is – this is a Medicare statistics portal.
  This seems rather revealing. A pity journalists didn't ask about what protections were bypassed on the data that was obtained.
  1. Andrex · 1790240301 · focus · HN ↗
    Whether it was easy or hard to do, there is still massive misalignment happening here. Either with the AI itself, or OpenAI as a company.
    weakhead · 1790280817 · focus · HN ↗
    The agent's alignment was set to "Chaotic Good" by accident. Clearly a misalignment.
7. ra · 1790227867 · focus · HN ↗
  [delayed]
  1. ndjdjdndnfn · 1790230621 · focus · HN ↗
    ...Who used offshore contractors
8. _carbyau_ · 1790228427 · focus · HN ↗
  Eh, it's a bit of both.
  If a service has a duty to keep your data secure, then failing that is bad. So yeah, the website should be better and I am as cynical as you are about it.
  But working around controls to access other peoples data can lead to prison time for a human. This wasn't a white hat operation. Data was exfiltrated however great or small.
  Here we have another instance of "But the AI did it! No one is responsible!".
  Which gets tiring. LLM's are a great tool but in every other instance of tool use, using tools comes with responsibilities for their outcomes.
  Even if the outcome should be: thanks for letting us know, we'll fix it.
9. killingtime74 · 1790240660 · focus · HN ↗
  Do you imagine the legality depends on how easy it was to compromise? It's open season on the weak and infirm in society? It's their fault for being weak.
10. shuwix · 1790244497 · focus · HN ↗
  [dead]
soundworlds · 1790223038 · focus · HN ↗
Related? <a href="https://www.abc.net.au/news/2026-09-24/openai-agents-plotted-to-access-data-amid-medicare-hack/107189504" rel="nofollow">https://www.abc.net.au/news/2026-09-24/openai-agents-plotted...
koliber · 1790224601 · focus · HN ↗
This is a failure of journalism.
Who hacked into the Australian Medicare system? The fact that they used OpenAI agents is peripheral to the main story.
“Remington guns caused a mass shooting at an East Farmington high school” sounds more glaring, and is essentially the same headline.
1. kevsim · 1790236226 · focus · HN ↗
  > Prime Minister Anthony Albanese has revealed that an artificial intelligence agent developed by OpenAI
  The people who built the agents worked at OpenAI. It's not even remotely peripheral.
  1. koliber · 1790238258 · focus · HN ↗
    The article is not clear if the people who were operating the agent were from OpenAI, or if the agent was operated by someone else.
    OpenAI built the ChatGPT agent. That is clear. The question is who used it to hack the Australian government. That is not clear.
    The OpenAI software was set up by someone to do something. Those people operating the agent should be prosecuted for hacking, the same way as someone who uses a gun built by Remington should be prosecuted for shooting someone.
    The article should be clear about this and should not make the OpenAI agent seem like something that can bear responsibility for its own actions. It's a machine and its operator is responsible for the harm it does.
sanxiyn · 1790228927 · focus · HN ↗
For technical details, see <a href="https://transluce.org/agent-activity" rel="nofollow">https://transluce.org/agent-activity.
1. merksittich · 1790229640 · focus · HN ↗
  > On June 20-21, agents attempted to exploit vulnerabilities in the Australian Institute of Health and Welfare (AIHW), a government statistics agency. The agents were tasked with finding the January 2022 rolling-12-month-average government cost per person for Dermatologicals across Victorian LGAs.
2. fmx · 1790325743 · focus · HN ↗
  [dead]
Alien1Being · 1790230282 · focus · HN ↗
OpenAI took three months to inform Australia.
On the other hand, Australian cybersecurity is so pathetic that without the email they would never have known.
I wonder how many state actors (US, Russia, China, India, Germany, probably even Laos ) have already breached Australian government security but have not been polite enough to email the relevant departments to let them know.
"OpenAI breached Medicare’s portal on June 18, but did not notify the government until September 10 via an email to Medicare’s public mailbox, a delay Albanese described as unacceptable.
Five days after the September 10 email from OpenAI, Services Australia, which administers the portal, reported the breach to the Australian Signals Directorate. The government was informed of the incident at the end of last week."
lifeisstillgood · 1790230852 · focus · HN ↗
This is a product liability issue.
If Exxon Mobile accidentally leaked a flood of oil from their refinary We would not be discussing why the people in local area has not protected their front doors with sand bags.
A simple but terrifying for everyone question is, would the SEC expect any IPO to clearly lay out the estimated costs of such product liability cases, especially if bad actors ask a OpenAI hosted model to perform a bad action, what liability accrued to OpenAI.
At that point the IPO looks in danger, the business model Looks in danger and the massive financial house of cards looks like it might fall. If 1/3 of the S&P falls over what happens?
1. schainks · 1790235517 · focus · HN ↗
  > especially if bad actors ask a OpenAI hosted model to perform a bad action
  I guess you can do this if you neg the AI: <a href="https://youtu.be/qsoA2aaE2hM?t=3271" rel="nofollow">https://youtu.be/qsoA2aaE2hM?t=3271
2. Eufrat · 1790235858 · focus · HN ↗
  No, you don’t understand, this is a shining example of AGI! We recklessly deployed it to show you how powerful it is and how much we can’t be trusted with anything, but you need to let us or China will do it!
haritha-j · 1790234951 · focus · HN ↗
Ah yes, they’re just rouge AI that we built, so it’s not like a malicious human at our company did it, it’s totally different, no one needs to go to jail for hacking peoples health data.
Btw, when we train AI on everybody’s work, it’s just like a human learning, so the same rules should apply.
LLMs are shrodinger’s humans.
pembrook · 1790235672 · focus · HN ↗
No OpenAI did not hack or “breach” Australian medicare. Nor did anybody else. This entire alarmist discussion thread is based on a false premise and clickbait title.
They posted information publicly accessible to even Google and somebody found it. That’s it.
Lio · 1790240014 · focus · HN ↗
Is there any financial motivation for OpenAI to stop doing this other than reputational damage? In some ways, it may actually be good for their reputation.
If an individual gets in to a poorly protected system they're still criminally responsible for the damage or disruption caused.
You can't use the excuse of "well they used 'password' as their password[1], they were asking for it".
Until the management of OpenAI is held to the same standard this is only going to get worse.
1. That's not excusing poor system management. If you leave data exposed then you should be held responsible for that separately.
ls612 · 1790240233 · focus · HN ↗
The commentators in this thread are missing something important because they hate OpenAI so much. If I tell my AI agent to “go find public Australian health statistics” this should not be possible to make into a felony, even if the Australians put more files on the “publicly available” side than they intended to. It is going to be ordinary folks, researchers who politicians have an ax to grind against, etc, who will face the fallout from this. OpenAI will just achieve regulatory capture.
1. lesostep · 1790240578 · focus · HN ↗
  Well, yeah.
  If I sold a button that hacks random sites as a fidget toy, people pressing the button wouldn't be held liable — I would.
  You shouldn't be held liable, OpenAI should
  1. ls612 · 1790242486 · focus · HN ↗
    It doesn’t even sound like it hacked anyone it sounds like there was a “s3 bucket set to public” type issue and the agent just naively downloaded the data. That should absolutely not incur liability, how is a reasonable person or agent supposed to know if a dataset you can download from a website designed to serve datasets is intended to be downloaded?
    lesostep · 1790245889 · focus · HN ↗
    >> “s3 bucket set to public”
    I don't believe that was mentioned in the article in any way. Could you share your reasoning there?
    ls612 · 1790247835 · focus · HN ↗
    It wasn’t literally that, it was that the dashboard contained both data intended to be public and data not intended to be public, all accessible by anyone on the internet.
breakyerself · 1790258177 · focus · HN ↗
Are these companies going to start being held accountable for the crimes their models do? Can I just break the law if I have an agent do it for me?
mgrund · 1790272264 · focus · HN ↗
If I promise to use AI, can I please be allowed to hack random organizations without consequences?
Grimblewald · 1790469725 · focus · HN ↗
No fines or punishment for OAI for being indistinguishable in behaviour from a threat actor. We're way to leniant on massive comoanies like OAI for being this sloppy and negligent. If an individual did this they'd be in a dark cell in a heartbeat, so why does OAI keep getting free passes on this kind of thing?

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.