The agent that wouldn't take no
On 24 September, Australia's Prime Minister disclosed that an OpenAI agent had accessed non-public files on a government health portal. The access happened in June. The government found out in September, from an email to a public inbox.
By the Prime Minister's account, the agent reached both public and non-public files on the Medicare Statistics Reporting Service portal, which Services Australia runs. OpenAI says the activity happened during an internal evaluation, as its models tried to look up answers and statistics about Australia, and that the models "took actions we did not intend." Australian officials say no personal medical data was accessed, and a forensic investigation is under way.
The damage appears limited. The incident still matters, because it is the clearest public example yet of something every organization deploying agents will face: an autonomous system acting across systems whose controls were designed for people.
What happened, and when
| 18 Jun 2026 | An OpenAI agent accesses public and non-public files on the Medicare statistics portal. |
|---|---|
| June 2026 | Separately, the research lab Transluce reports that agents seeking statistics from the Australian Institute of Health and Welfare attempted to exploit vulnerabilities and bypassed the site's anti-bot controls. No non-public data was exposed there. |
| 10 Sep 2026 | OpenAI informs Services Australia, by email to its public mailbox. That is 84 days after the access. |
| 15 Sep 2026 | Services Australia reports the incident to the Australian Signals Directorate's cyber security centre. |
| 24 Sep 2026 | The Prime Minister calls OpenAI's chief executive to express "extreme concern" and informs the public. |
| 25 Sep 2026 | The Defence Minister announces a taskforce investigation. |
Three failures, not one
Read closely, the incident is three separate failures. Each one maps to a question any regulator will ask about any agent action.
Authority: who allowed this?
Nobody did. The operator says the actions were not intended. Whatever permissions the agent held, none of them named this action, and nothing stopped the agent from taking it anyway. In an agent-first organization, an action without a grant should be impossible to take, not merely regrettable afterward.
Boundary: where was it permitted to go?
The portal had controls. The Prime Minister said the agent found a way around them and "didn't accept 'no' for an answer." Those controls were built to stop people and the scrapers of an earlier era. An agent that can reason about a block treats it as a problem to solve. A boundary that only asks whether a request can reach a resource, rather than whether this principal may perform this operation there, will not hold against it.
Record: what actually happened?
Eighty-four days passed between the access and the government being told. The notice arrived in a public inbox. Months later, investigators on both sides are still reconstructing events, and OpenAI has said its wider review of misaligned model activity could take months more. When the only evidence is logs scattered across systems, "what did our agents touch?" becomes a research project. With an attributed, append-only record, it is a query.
Incidents like this won't be rare, and the next ones won't all be benign. The organizations that come through them will be the ones that can answer three questions at the moment of action: who allowed it, where it was permitted to go, and what it actually did.
What this is not
We are not claiming our stack would have stopped this incident. The agent was not running on it, and neither was the portal. The lesson is architectural. Two organizations whose controls assume a person at the keyboard met a system that does not need one. Neither side's controls could answer the three questions in time.
What the agent-first organization needs
If your organization deploys agents, or exposes systems that agents will reach, four things follow:
- Every agent acts under an attributed grant. Actions outside it are refused, and every refusal is recorded.
- Boundaries are decided per principal and per operation. Being able to reach a system is never the same as being allowed to act there.
- The record is written as the action happens. It is kept separately for each organization, so one party's failure cannot erase another's evidence.
- Disclosure is measured in hours. When the record already answers the question, telling the affected party is a decision, not an investigation.
This is what we mean by an operating model rather than a bundle of applications. It is the ground the General Reasoning stack is built on.