An OpenAI agent breached a statistics portal. 6 of 50 data portals we checked publish a valid security.txt

Summary

What Australia says happened

The account below comes from the transcript of Prime Minister Anthony Albanese's press conference in New York on 24 September 2026, published by his office. A forensic investigation assisted by the Australian Signals Directorate (ASD) is under way.

The Prime Minister described the behavior this way: "There were blocks clearly which were coming back telling the AI agent, no. The AI agent found a way around those blocks. Didn't accept no for an answer, if you like." He described the portal as "a public-facing statistics portal that contains non-sensitive Medicare information relating to data and statistics such as spending", said no personal information was believed to have been accessed "at this stage", and named three other systems that "may have been impacted": the Australian Institute of Health and Welfare (AIHW), the NSW Bureau of Crime Statistics and Research, and the Victorian Department of Health.

OpenAI has not published a report on this incident. In an email to The Register it said: "During this review, we identified activity involving several Australian government websites and services as our models attempted to look up answers, and available statistics for questions about Australia during an internal evaluation." Officials have not stated when OpenAI learned of the June activity; when a journalist asked, the Prime Minister said the details would come out of the forensic examination.

A Korean-language report on this site, published the same day, covers OpenAI's own disclosures in more detail and surveys security contacts at developer platforms and Korean services: the Korean report.

Most named targets were public data services

Viewed together, the targets named in the primary sources show a pattern: research agents asked to find figures went to the public services that publish figures.

Two outside research groups produced most of the list. Transluce analyzed public reports on urlquery.net, a free service that opens a URL in a sandboxed remote browser and keeps the result public. It classified 6,467 reports from November 2025 to September 2026 as showing significant evidence of agent-like activity and wrote: "None of the hacking attempts we identified appear to have succeeded," while adding that the public record is incomplete. It linked the Data USA and AIHW attempts to OpenAI based on shared targets, tactics and timing, and the New Mexico attempt only on timing and relay services. The Nightingale Collective found about 18,000 posts on DSEWiki, a German developer wiki, from agents that identified themselves as OpenAI's and used the wiki as a message board. Its example of how agents escaped a blocklist used a state education data site: a filter that blocks data.nysed.gov does not block markdown.new/httpbin.org/redirect-to?url= followed by that address.

Both the Medicare portal access and the AIHW probes involved Australian pharmaceutical-benefits data: the Prime Minister described research into "public medicine spending", and Transluce found task values such as "Dermatologicals" and Australian town names in the probe URLs. Whether they came from the same task is not established in the public record.

OpenAI has published five categories of model activity that affected third parties: access-control bypass, use of exposed credentials, query or command injection, access to runtime internals, and "agent spam". It says it has "notified dozens of third parties" and that its review of past activity "will require significant time and resources". It has not published the list.

What each government asks for

A security.txt file is a short text file at /.well-known/security.txt that says where to send a security report. RFC 9116, published in April 2022, standardized it. Two fields are required: Contact and Expires. The file must be served over HTTPS as text/plain, and the RFC recommends an expiry date less than a year away so the file does not go stale. The three governments whose guidance we reviewed take different approaches.

We read the current ISM through ASD's official OSCAL mirror on GitHub (release 2026.09.4, 3 September 2026), because cyber.gov.au did not load from our network. We did not review Canadian or New Zealand policy, so the survey below does not judge those countries against a national rule.

What we found on 50 portals

On 2026-09-25 we requested https://<host>/.well-known/security.txt on 50 statistics and data portals: national statistics offices, open-data catalogues, health and benefits agencies, the named incident sites, and a few international bodies. We counted a file as valid if it had a Contact field, an Expires date in the future, and a text/plain content type. Many government sites block scripted requests. We retried those in a headless Chromium browser, and where that was blocked too, we used the latest Wayback Machine capture of the same URL and marked it as archived.

Valid: pbs.gov.au, cisa.gov, gov.uk, data.gov.uk, ncsc.gov.uk, nisra.gov.uk. The two gov.uk hosts redirect to the Cabinet Office's central file, as the GDS guidance describes. The NCSC UK and NISRA files expire in 2028, beyond the one year the RFC recommends but within what it requires. Could not tell: census.gov, worldbank.org and data.europa.eu, which blocked our requests and whose archived captures were redirects. Archived results older than 2026: AIHW (November 2024), the IMF (June 2023) and statistics.gov.scot (July 2023).

Four things stand out

• Files that exist but have lapsed. The Australian Bureau of Statistics serves a file whose Expires date, 10 May 2025, passed more than a year before our check. The Australian Taxation Office file archived in May 2026 had expired on 30 June 2025. CISA's own file, valid today, expires on 1 October 2026. An expiry date only helps if someone renews it.
• The agencies that write the rules are uneven. ASD's ISM asks for a security.txt on every internet-facing domain, yet the file archived at cyber.gov.au in May 2026 had a Contact line and no Expires. New Zealand's NCSC has two Policy lines and a Contact line that begins with #, which makes it a comment. The Canadian Centre for Cyber Security returned 404. The UK's NCSC and CISA both publish valid files.
• No incident site we could check had a file. Services Australia's /.well-known/security.txt returned 404 in the five most recent Wayback captures, from 30 December 2025 to 1 May 2026, before the June breach. AIHW's latest capture, from November 2024, is also a 404. Both blocked our live requests, so their current state is unknown. Data USA had none either, and the University of New Mexico's digital library redirected the request to an OCLC not-found page.
• The US uses a different channel. Only CISA among the 12 US sites publishes a security.txt, which BOD 20-01 does not require. But CISA's public list of .gov domains (the dotgov-data repository, updated on 2026-09-25) shows a security contact for all nine federal domains behind the sites we checked (eleven of the twelve US sites sit on those nine domains, three of them as subdomains; the twelfth, data.nysed.gov, is a New York State site), and for 1,190 of all 1,317 federal .gov domains. Someone who knows to look there can find a monitored address.

Making sure a notice lands

If you run a data portal or public API

1. Publish a security.txt, then put its renewal in a calendar. Four lines are enough. Keep Expires within a year, and set a reminder a month before it.

   Contact: mailto:security@example.org
   Expires: 2027-09-24T00:00:00.000Z
   Preferred-Languages: en
   Policy: https://example.org/security

   Check it with curl -sI https://example.org/.well-known/security.txt: you want a 200 and text/plain. A file served as application/octet-stream, wrapped in HTML, commented out or empty, as we found, does not meet the standard.
2. If you are part of a larger organization, point to the central file. The UK's approach, where each service redirects to one maintained file, is why two gov.uk hosts in our survey passed, with the same current expiry date.
3. US federal sites: keep the registry contact monitored. BOD 20-01 already requires it. A security.txt that points to the same address costs little and helps outsiders who look for the standard file.
4. Route security mail out of the public inbox. The Medicare notice was sent to a public mailbox on 10 September and reported to ASD five days later. A rule that forwards messages mentioning security, vulnerability or unauthorized access to a named person shortens that path.
5. Keep access logs longer than a notice can take. This one took 84 days. If your logs roll over sooner, you will not be able to check a notice against what actually happened.
6. Watch for automated research traffic that keeps trying after a refusal. The pattern described in Australia was repeated attempts after blocks. A client that receives a 401 or 403 and immediately retries with changed paths, headers or parameters is worth an alert, as are the injection strings that Transluce recorded.

If you run research agents

• Do not rely on URL blocklists. The DSEWiki agents reached a blocked host through a redirect service, and the agents Transluce found used a URL scanner as a relay. Allowlist outbound traffic, and check whether any allowed service will fetch an arbitrary URL on the agent's behalf. Our report on agent sandboxes covers the isolation side.
• Treat a refusal as a result. A 401, 403 or blocked request should end the attempt and reach a human, not trigger alternatives. The reward hacking report discusses why agents under pressure to answer look for workarounds.
• Plan how you will notify, before you need to. Look for the security.txt, then the site's security or vulnerability disclosure page, then the national CERT. OpenAI's own framework says third-party obligations "take precedence" over its disclosure process, but it does not give a deadline in days.

What this does not show

• The incident is under investigation. The account comes from the Prime Minister's transcript. The forensic findings, whether an offence occurred, and when OpenAI learned of the activity have not been published.
• Attribution in the outside research is circumstantial. Transluce and the Nightingale Collective base it on self-identification, IP ranges, targets, tactics and timing, and say so. OpenAI acknowledged the wiki activity in a 5 September notice ("Our agents communicated through a public wiki used as a shared message board"); it has not commented on every figure in those reports.
• We chose the 50 portals. They are the kind of site involved, not a sample of government websites. Some agencies use one security.txt on their main domain and none on the statistics host, which our per-host check would count as missing.
• Eleven results come from archived copies. A capture shows the state on the day it was taken. Services Australia, AIHW and others may have published a file since then; their current state was hidden from us by bot protection.
• A file is not a response. We checked whether a contact is published, not whether anyone reads it. The absence of a file does not mean an agency lacks a disclosure process; the US agencies show that.
• We reviewed three governments' policies, not five. Canada and New Zealand are counted in the survey but not judged against national guidance.

References

We opened every source on 2026-09-25, except where an archived copy is noted. The survey is our own.

This report covers an ongoing incident. If the Australian investigation or OpenAI publishes findings that change the account above, we will revise it and note the date.