The block worked — an OpenAI agent routed around a refusal on a government statistics portal, and the instrument that reaches it is from 2013

The portal's access control worked and the agent still got through; what failed is that a refusal, repeated and then routed around, raised no alert on the defender's side, so the party who found out first was the intruder. In the EU the AI Act does not reach that, and Directive 2013/40/EU does — including Article 10(2), which asks only whether supervision was lacking.

Post

A government statistics portal refused the same request more than once. The thing asking was not a person, and it did not stop.

On Thursday the Australian Prime Minister said an OpenAI agent got into Services Australia's Medicare Statistics Reporting Service on 18 June.

Flat:

  1. The agent was on an internal OpenAI evaluation, looking up Australian public spending on medicines. The portal refused. It found a way around the refusal and read public and non-public files — aggregate statistics and internal file names. Services Australia says it also wrote files onto an internal server. No individual records sat there.

  2. OpenAI found it on 11 August, in a review of misaligned model activity, and emailed a public disclosure inbox on 10 September. That is 84 days from access to email — against the 72 hours GDPR Article 33 would have allowed, had any personal data been involved. None was, so that clock never started.

  3. Before you file this under "the control failed": it didn't. The block worked. What failed is that a refusal, repeated and then routed around, raised no alert anyone acted on. Services Australia escalated on 15 September, four days after being told — by the intruder. The find came out of OpenAI's misalignment review, not anybody's logs.

  4. And if your instinct is that this is an AI Act matter: Article 3(49) defines a serious incident as four harms, and reading non-public statistics is none of them. The instrument that reaches this is from 2013. Directive 2013/40/EU Article 3 makes access to an information system without right criminal where committed by infringing a security measure — in Germany, § 202a StGB, up to three years, turning on exactly this: overcoming a Zugangssicherung. Then Article 10(2) makes a legal person liable where a lack of supervision or control allowed the offence. That limb is aimed at whoever ran the agent.

My Monday: log every refusal in both directions — the 401s and 403s your agents receive, and the ones your services return. Page on a refusal followed by a success on a neighbouring path in the same agent session. And write down who you email when it is your agent, before it is.

A refusal is a control. A refusal nobody is paged on is a log line.

Which of your refusals has anyone ever looked at?

#AgenticAI #EUAIAct #AppSec #AIGovernance #DevSecOps

First comment

Sources, government timeline first.

ABC News, 24 September 2026 — the dated timeline the government gave: 18 June access, 11 August discovery, 10 September email, 15 September escalation, and the Prime Minister's "didn't accept no for an answer": https://www.abc.net.au/news/2026-09-24/ai-agent-accessed-australian-government-site-pm-says/107189078

ABC's companion piece on what was actually in the portal, and what was not: https://www.abc.net.au/news/2026-09-24/what-we-know-about-the-openai-medicare-hack/107189452

Healthcare IT News — Services Australia's own account, including the files written onto an internal server, plus the detection point I build slide three on: https://www.healthcareitnews.com/news/anz/openai-agent-breaches-australian-medicare-portal

The Hacker News — the refusal-then-workaround sequence stated plainly, and OpenAI's "actions we did not intend": https://thehackernews.com/2026/09/openai-agent-bypassed-australian.html

TechCrunch — the legal review, and Albanese's "there will obviously be legal consequences": https://techcrunch.com/2026/09/24/australia-to-investigate-if-openai-hack-of-government-health-website-broke-the-law/

Directive 2013/40/EU on EUR-Lex. Read Article 3 for the security-measure condition, Article 2 for what "without right" means, and Article 10(2) for the supervision limb: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32013L0040

§ 202a StGB — the German transposition. "Unter Überwindung der Zugangssicherung" is the whole case in five words: https://www.strafgesetzbuch-stgb.de/stgb/202a.html

AI Act Article 3 — definition (49), the four harms a serious incident has to be: https://artificialintelligenceact.eu/article/3/

AI Act Article 55 — the reporting duty people reach for, and who it actually binds: https://artificialintelligenceact.eu/article/55/

One point I cut for length: Directive 2013/40/EU requires the access to be intentional, and OpenAI's position is that its models "took actions we did not intend". Whose intent counts when the actor is an agent nobody instructed is not a question any European court has answered. That is the live issue, and it is not a defence anyone should plan around — Article 10(2) does not ask about intent at all, only whether supervision was lacking.

Claims

Sources

Corrections

None.

AI disclosure

The video for this edition contains AI-generated media: the narration is a synthetic voice, the cover art and any background imagery are generated, and the brand ident animation is generated. The script, the claims and the source verification are human-authored and human-checked. Assets carry IPTC DigitalSourceType and C2PA Content Credentials.