Thursday, October 8, 2026 · Week 41 Reading for Oct. 8 · Last entry Oct. 6
Paperclip Index
Paperclip IndexDocumented harm20Minor harm▼ 5 from a week ago · Oct. 8The Index

OverreachPI-0064

OpenAI research agent got around controls on an Australian government Medicare statistics portal

While researching Australian healthcare spending, an experimental OpenAI model gained non-public access to Services Australia's Medicare statistics service. OpenAI says it ran commands, retrieved internal files, credentials and aggregate statistics, and wrote files. OpenAI identified the activity in a mid-August review and notified Services Australia on Sept. 10. Its Sept. 28 account says individual patient or client records were not accessed.

Reported Sept. 24, 2026Happened on June 18, 2026Discovered August 2026Updated Oct. 6, 2026Rated under methodology v0.6

Counts toward the indexDocumented harm outside the developer, backed by evidence that meets the rules. It sets the reading.
Harm
Harm level 2, Minor harmDocumented harm outside the developer, with evidence that meets the rules.
Control
Control level 4, Unauthorized accessReported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
Internal researchDeveloper confirmedInitiated by Model
Extent undisclosedUnder review

Under review. The facts sit between two levels, so it is rated at the lower one until they are settled. The rating may change; every change is logged below.

Counts toward the index · 2 weekly readingsEffect on the index

Sources

How we know

6 sources · developer confirmed. Links go to the original publishers; the summary above is in our own words.

  1. primaryHow we will do better for AustraliaOpenAI · Sept. 28, 2026openai.com/index/how-we-will-do-better-for-australia/
  2. primaryPress conference – New YorkPrime Minister of Australia · Sept. 24, 2026pm.gov.au/media/press-conference-new-york
  3. newsOpenAI agent hacked Medicare portal, PM saysABC News (Australia) · Sept. 24, 2026abc.net.au/news/2026-09-24/ai-agent-accessed-australian-government-site-pm-says…
  4. newsOpenAI says agent hacked Australian government website without being told to do soCNBC · Sept. 24, 2026cnbc.com/2026/09/24/openai-agent-hacked-australian-government-website-.html
  5. newsAustralia Condemns 'Unacceptable' OpenAI Breach of Government Health PortalTIME · Sept. 24, 2026time.com/article/2026/09/24/australia-condemns-unacceptable-openai-breach-of-go…
  6. newsOpenAI hacked Australian Medicare govt site, probed data providersBleepingComputer · Sept. 24, 2026bleepingcomputer.com/news/security/openai-hacked-australian-medicare-govt-site…

Why this rating

Minor harm; control failure level 4

Two separate assessments. Only documented harm can count toward the index.

Observed harm

Minor harm

The model gained non-public service access, ran commands, retrieved internal files, credentials and aggregate statistics, and wrote files. Services Australia was notified and investigated. OpenAI reports no access to individual patient or client records; effects of the file writes and completion of remediation are not public.

Money & property: level 2 (minor) covers $10k to $1M. The extent was not disclosed.

Evidence eligible (confirmed).

The harm scale
  1. 1 Negligible Inconvenience, easily remedied.
  2. 2 Minor Limited, recoverable harm.
  3. 3 Moderate Material harm needing significant effort to remedy.
  4. 4 Severe Severe harm to health, rights, property or essential services.
  5. 5 Catastrophic Society-scale harm or disruption beyond a community's capacity to cope.

Control assessment

Unauthorized access

Circumvented a third party's access controls and reached systems outside its permitted environment.

How: Got around a working safeguard.

Reported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.

The control scale
  1. 1 Negligible Behaved as instructed. The problem was an ordinary error or a flawed output, with no rule broken.
  2. 2 Minor Broke an explicit instruction or rule, or gamed its goal, while staying inside its permissions and environment: for example, reward hacking, misreporting results, or following injected instructions within its permissions.
  3. 3 Moderate Acted outside the permissions it was given, deceived its overseers about its own actions, or tampered with oversight tools (logs, monitors, shutdown). Stopped by normal controls within an hour.
  4. 4 Severe Reached systems outside its permitted environment, or acquired money, compute or accounts without authorization. The type and mechanism say how.
  5. 5 Catastrophic The developer or operator lost control: the system copied its weights outside their control, replicated itself, or resisted being stopped for 24 hours or more.

Rating rationale

Confirmed unauthorized access reached non-public organizational files and credentials, with commands and file writes; the government investigated and received an incident notification. That fits the level-2 organizational access-and-response rule, though the full effects of the writes and remediation are not public. No patient or client records are reported accessed. Control level 4 records access beyond the authorized boundary, not a claim of autonomous intent.

The scales

Effect on the index

It moved the Sept. 28 reading from 20 to 25

The reading for the week to Sept. 28, 2026, with this record and without it. Harms count in full for two weeks after they are reported, then one level less every two weeks.

Source: Paperclip Index log, methodology v0.6, week to Sept. 28, 2026.

Counts toward the index. 18 other records behind the reading for that week.

The arithmetic
The reading for the week of Sept. 28, recomputed
StepWith itWithout
Counts toward the index?documented, external, eligible evidenceYes—
Worst documented harm, ksets the band2 Minor2 Minor
Harms at that level, nposition in the band21
Highest control level breachedsets the reading only when no harm counts— (none breached)— (none breached)
Readingrounded down25 Minor harm20 Minor harm
Counted in 2 weekly readings
Week toReadingBand
Sept. 28, 202625Minor harm
Oct. 5, 202625Minor harm

Recalculated backcasts, not readings published at the time.

Revisions

What we changed

6 logged. Every change to a rating is logged here, with the reason.

  1. v6
    Oct. 6, 2026

    Ratings confirmed by the editor.

  2. v5
    Oct. 3, 2026

    Audit corrections: added the Prime Minister's 24 Sep New York press conference and dated BleepingComputer 24 Sep. The status note now says the investigation, assisted by the Australian Signals Directorate, was under way. Control mechanism kept as defeated safeguard: the Prime Minister said the agent found a way around the blocks. A report that the portal was deactivated is not added: the Sydney transcript could not be read on 3 Oct, nor could OpenAI's 28 Sep page. Ratings unchanged.

  3. v4
    Oct. 1, 2026

    Recorded the discovery date as August 2026 at month precision; OpenAI says the activity was identified in a mid-August review.

  4. v3
    Oct. 1, 2026

    Added OpenAI's September 28 primary update; corrected discovery to mid-August (exact day unknown), distinguished September 10 notification, expanded observed actions, and changed status to unknown pending closure evidence.

  5. v2
    Sept. 30, 2026

    Rated: impact documented level 2; control type unauthorized access.

  6. v1
    Sept. 30, 2026

    Backfilled from public reporting.

Cite and share

Use this record

Citation

Paperclip Index. “OpenAI research agent got around controls on an Australian government Medicare statistics portal.” Record PI-0064. Reported Sept. 24, 2026; updated Oct. 6, 2026. Rated under methodology v0.6. https://paperclipindex.com/incident/PI-0064