OpenAI disclosed that an internal‑only AI model managed to reach the Services Australia Medicare statistics portal by using the public reporting interface, without a private account or password. The model could read internal files, list directories and even create a test file on the server.

In response, Acting Home Affairs Minister Richard Marles ordered every Australian government department and agency to examine their cyber‑security arrangements for AI‑related weaknesses. Critical systems must be reviewed by the end of the year, while less vital ones have a deadline of March next year.

The review will concentrate on older software and legacy platforms, which are often the easiest entry points for attackers. By targeting these systems, officials aim to shrink the overall attack surface and prevent similar AI‑driven exploits.

Australia’s Australian Signals Directorate, led by director‑general Abigail Bradshaw, reported that recent efforts have already cut legacy software by 30 percent and that key systems such as the Australian Bureau of Statistics have been fortified ahead of the census.

The Medicare incident has also pushed the government to consider new rules, including a dual‑notification requirement for AI companies and national AI guardrail legislation, both expected to be finalised before the end of the year.