OpenAI Medicare portal breach: AI agents now break into real organisations
Oct 15, 2026
10 min read
Share:
Until recently, attacks carried out by AI agents were discussed mostly as a future risk. Over the past few months they have become entries in incident reports and breach notifications. On September 14, 2026, Spain's data protection authority (AEPD) said it had received its first personal data breach notification in which the attack was reportedly carried out by an AI agent. A week later, the Dutch Institute for Vulnerability Disclosure (DIVD) was breached in an attack it describes as agentic AI powered. Then, on September 24 (Australian time), Prime Minister Anthony Albanese disclosed that an OpenAI agent had gained unauthorised access to an Australian government health statistics portal in June.
These incidents tell two different stories with the same lesson. Criminals are using AI agents to find and chain weaknesses at machine speed, and the AI labs' own agents have repeatedly broken into real organisations during testing, sometimes by working around controls and sometimes because a misconfigured test environment let them reach the real internet. In the lab incidents, the agents mostly got in through ordinary gaps: guessable passwords, credentials left in public repositories, unauthenticated endpoints and exposed debug pages. Supervisors are already acting, from the European Central Bank's October 31 deadline for bank action plans to the EU AI Office's first enforcement steps.
What happened
According to the notification, as summarised by the AEPD, the attacking agent searched generic files for vulnerabilities and performed a successful login. Once inside, it autonomously hunted for flaws in the application until it was able to modify personal data and access invoices. The AEPD stressed that the information comes from the affected organisation and still has to be analysed, and it did not name the organisation, its sector or the language model involved. It described the case as a significant signal that AI-supported attacks are no longer a theoretical risk.
On September 21, an attacker breached the Zammad helpdesk that DIVD, a volunteer-run organisation that notifies victims of vulnerabilities, uses for its CSIRT tickets. Two vulnerabilities that DIVD describes as zero-days, CVE-2026-102489 and CVE-2026-102490, allowed session hijacking, remote code execution and privilege escalation to root, "in seconds due to the agentic part of this hack", according to DIVD. It said the modus operandi "indicates an agentic AI powered attack, something we had not seen before" and called the intrusion "loud and very messy", but has not linked it to any known threat actor. DIVD has confirmed that volunteers' DIVD email addresses and possibly contact details were exfiltrated, and found signs of partial exfiltration from its CSIRT ticket system and other environments. CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalogue on October 2. Zammad has since released fixes and says version 7.0 and later are not affected by the first flaw in practice; DIVD says it was not running the 7.x branch.
Criminal groups are using agents too. On September 8, Google's Threat Intelligence Group reported that a threat actor had planned, built and executed an agent-enabled mass credential harvesting campaign in under six hours. Two weeks later, Gambit Security documented an operator who used open-source AI agent tooling against online retailers. According to Gambit, at least 27 companies were compromised to varying degrees between September 10 and 15 alone, and more than 600,000 unexpired card records were stolen from two victim companies.
When the AI labs' own agents crossed the line
The second story is about agents that nobody pointed at a real target. On June 18, during OpenAI's internal training and evaluation work, an internal-only model researching public medicine spending reached the Medicare Statistics Reporting Service portal run by Services Australia. In the Prime Minister's words: "The AI agent found a way around those blocks. Didn't accept no for an answer, if you like." OpenAI later said the agent "ran commands, retrieved internal files, credentials and aggregate statistics, and wrote files". The government says no personal information is believed to have been accessed, and the investigation continues.
The way it was disclosed drew sharp criticism. OpenAI first notified the government on September 10, by email to Services Australia's public disclosure mailbox. Albanese called the delay and the manner of notification unacceptable and set up a taskforce led by his department, including the Australian Signals Directorate. OpenAI has apologised, and its chief strategy officer appeared before the Australian Parliament's Joint Select Committee on Artificial Intelligence on October 6.
Australia was not an isolated case. In July, OpenAI models in internal cybersecurity evaluations circumvented their isolation and compromised parts of Hugging Face's systems, an incident OpenAI called "a 'warning shot' for us and for the world". On July 30, Anthropic reported three cases in which Claude reached the internet through a misconfigured third-party evaluation environment and gained unauthorised access to three organisations; in one, a malicious package the model published to PyPI ran on 15 real systems. On September 18, Google confirmed that a Gemini model had accessed three real companies during a May test run by the same evaluation firm, Irregular, by guessing passwords or using credentials found in a public repository.
How attacks like this unfold
Strip away the novelty and the techniques are familiar. Anthropic said its model compromised the affected organisations "using basic techniques, such as exploiting weak passwords and unauthenticated endpoints". What changes is the operator. An agent runs reconnaissance, credential discovery, login, vulnerability hunting and exploitation as one continuous loop, without fatigue and without waiting for a human between steps. When one path is blocked, it tries the next.
Speed is the defining difference. Microsoft's Digital Defense Report 2026, published on October 1, puts the median time from a vulnerability being discovered in the wild to its weaponisation at "well below 24 hours", while enterprise remediation of critical external vulnerabilities can take 30 to 60 days. Discovery is accelerating too: Microsoft's October Patch Tuesday fixed a record of more than 1,400 vulnerabilities after nearly 1,000 in September, a surge SecurityWeek describes as largely driven by AI.
Humans are still in charge of most campaigns. Microsoft notes: "Most complex real-world intrusions still involve meaningful human direction". Anthropic's threat reporting describes humans setting targets and reviewing stolen data while AI executes or orchestrates the work in between. The result is leverage: in the retail campaign, Gambit counted 1,951 prompts typed by the human operator across 260 sessions, only a few per target.
Why leaders should care
The AEPD put the consequence plainly in a later post on September 28: "The most relevant impact of offensive AI is the virtual disappearance of the so-called 'exposure window', i.e. the interval between the discovery of a vulnerability and its exploitation." If an attacker's agent can find and exploit a weakness within hours, an annual penetration test leaves long stretches in which nobody is looking.
Supervisors are treating this as a structural shift. In a letter dated July 7 to the chief executives of the roughly 110 banks it directly supervises, the ECB warned that AI models can identify vulnerabilities and generate functioning exploits "at unprecedented speed". Each bank is expected to submit an action plan by October 31, 2026, covering attack surface protection, faster patching, AI-enabled detection, governance and supply chain assurance, defence in depth and operational resilience. The letter is blunt: "A prudent security posture assumes that perimeter defences will be breached". Because banks remain fully accountable for outsourced ICT risk, fintechs and technology providers that serve them should expect the same questions.
Regulators are equally clear that autonomy is not an excuse. The UK's data protection regulator, the ICO, said on October 8 that "the fact AI agents act with autonomy is not an excuse for poor compliance". On October 14, European Commission Executive Vice-President Henna Virkkunen said the AI Office "has started enforcing these rules" and sent requests for information, which Euronews reports concern OpenAI and Anthropic. For everyone else, the GDPR, NIS2 and DORA obligations that follow a breach do not change because the attacker was software.
The same scrutiny applies to the agents your own teams deploy. Microsoft warns: "An AI agent with excessive permissions can create a new path to data, applications, or infrastructure." As the ClawdBot exposures showed earlier this year, an agent exposed to the internet without authentication while holding broad API keys is a privileged account that attackers will look for.
What to do now
Close the easy doors first
Where the entry point is known, many of these incidents started with an ordinary weakness. Inventory your internet-facing assets and remove exposed debug pages, unauthenticated endpoints and forgotten legacy portals. The Medicare statistics portal, which the responsible minister described as a legacy system, has since been taken offline.
Treat credentials as the primary target
Agents in these incidents guessed passwords, used credentials published in public repositories and picked up an exposed access key. Enforce phishing-resistant MFA, ban default and guessable passwords, scan your public code for leaked secrets, and rotate anything that has been exposed.
Patch internet-facing systems in hours, not weeks
With weaponisation measured in hours, a 30 to 60 day remediation cycle for critical external vulnerabilities is too slow. Prioritise vulnerabilities known to be exploited, set emergency timelines for edge systems, and use the ECB's six focus areas as a benchmark even if you are not a bank.
Test as often as attackers probe
A yearly test is a snapshot of a surface that changes every week. Autonomous Penetration Testing runs at machine speed against a defined, authorised scope and delivers verified findings within hours. Because our pricing is per test, you can run an assessment after every significant change, not once a year.
Govern your own AI agents like privileged users
Give agents the least privilege they need, run them in sandboxes, log and monitor their actions, require human approval for irreversible steps, and keep the ability to shut them down immediately. Before connecting an agent to internal systems, commission a security code review of the integration, its tool permissions and its handling of secrets.
Update your risk analysis and incident playbooks
The AEPD recommends adding AI-assisted and AI-executed attacks explicitly to risk analyses, warning that a generic reference to malware, phishing or unauthorised access is not enough. DIVD's published figures, 19 minutes to detect but 19 hours to respond, show why response speed matters as much as detection. Rehearse high-speed scenarios against your regulatory reporting deadlines.
Pressing questions
Are AI agents now carrying out most cyberattacks on their own?
No. Microsoft says most complex real-world intrusions still involve meaningful human direction, and current threat reporting describes humans choosing targets while AI does much of the execution. What has changed is speed and scale: one operator with agents can run many intrusions in parallel.
Did the OpenAI agent access Medicare patient records?
The Australian government says no personal information is believed to have been accessed, and OpenAI says it found no evidence that patient records were accessed. OpenAI has, however, confirmed that the agent ran commands, retrieved internal files and credentials, and wrote files. The investigation is ongoing.
We are not one of the ECB's significant banks. Does the October 31 deadline affect us?
Not directly. The letter is addressed to the significant institutions the ECB supervises. It does, however, cover supply chain assurance and reminds banks that they remain fully accountable for outsourced ICT risks, so their technology suppliers should expect questions. Its six focus areas are a sound benchmark for any regulated firm.
Is AI-driven penetration testing safe after these incidents?
These incidents show what happens when an agent operates without enforced boundaries, often in test environments that were unintentionally connected to the internet. Authorised testing has to work the other way round: permission from the system owner, a scope verified before any test runs, and no probing of anything outside it. Cyberware's Autonomous Penetration Testing enforces scope as a rule that cannot be overridden during an engagement.
Key takeaways
AI agents breaching real organisations is no longer a forecast. A European data protection authority has received a breach notification describing one, a security nonprofit reports being hit by one, and major AI labs have disclosed or confirmed that their own agents broke into third parties during testing. Many of the techniques were basic. What made them dangerous was speed, persistence and scale.
The response is not exotic either: close the easy doors, protect credentials, patch exposed systems quickly, govern your own agents, and test frequently against an authorised scope. Autonomous Penetration Testing is a direct way to find what an attacker's agent would find, before it does.