Original Reddit post

I’m an Australian developer who’s worked in government in the past, and I’ve been following the OpenAI/Medicare story with a slightly different question from most of the coverage. I’m interested in AI as a tool, but I’m neither an AI doomer nor particularly interested in the ASI/end-of-humanity side of the debate. What I find fascinating about this incident isn’t really the “breach”. The Medicare Statistics Reporting Service was a public-facing, decades-old reporting system containing aggregate Medicare statistics. No personal Medicare information is believed to have been accessed. The government says the OpenAI agent accessed some “non-public” files, but so far this doesn’t sound like somebody getting into the actual Medicare claims system or extracting a database of patient records. And the recent Wayback Machine investigation makes the technical story even stranger. Recorded Future News/The Record reconstructed archived versions of the portal and found that its own production JavaScript explicitly referenced an unauthenticated SAS endpoint at /SASStoredProcess/guest . Apparently the site had been publicly accessible without authentication for years, and even after a login screen was introduced, guest access remained. So there’s a reasonable question about whether there was much of an “exploit” here at all. Maybe further forensic details will change that picture. But based on what’s currently public, it’s at least plausible that an agent simply followed application behaviour that a human developer poking around the site could also have discovered. That leaves me much more interested in this question: How did OpenAI notice? The incident happened on June 18. OpenAI apparently didn’t know about it at the time. It says it discovered it on August 11 while retrospectively reviewing “misaligned model activity”. That seems far more interesting to me than an old SAS application accidentally exposing some unpublished statistics. Think about the monitoring problem. An OpenAI research agent must make enormous numbers of web requests. Some URLs are documented. Some are obscure. Some aren’t linked. Some are API endpoints. Some are ancient government systems. Some return 403. Some unexpectedly return 200. There is no HTTP status called: 200 OK BUT ACTUALLY THIS FILE WASN’T MEANT TO BE PUBLIC If an unauthenticated URL returns some boring aggregate health statistics, how does OpenAI distinguish that request from millions of completely legitimate requests? Presumably the thing that brought this run to their attention wasn’t the URL itself. It was something in the agent telemetry . Perhaps: it encountered a refusal and started looking for alternative endpoints; it inspected application JavaScript; it changed request patterns; it discovered the SAS guest interface; it used some technique classified by OpenAI’s retrospective monitors as circumventing an access restriction; or its reasoning trace explicitly indicated that it believed it was getting around a restriction. If that’s what happened, I’d really like to see the trace. Because that’s potentially a much more consequential AI-safety/security story than “AI hacks Medicare”. The second interesting question is the reporting timeline. OpenAI discovered the incident on August 11. It didn’t notify Services Australia until September 10 — roughly a month later — and apparently did so by emailing the normal vulnerability-disclosure address. That seems oddly casual given the way the incident is now being described publicly. There are at least two interpretations worth discussing. One is that OpenAI behaved badly: it knew an autonomous agent had circumvented controls on an Australian government system and inexplicably sat on that information for a month. But another possibility is that, after investigating it, OpenAI genuinely regarded the actual Medicare incident as fairly inconsequential: an agent accessing non-sensitive aggregate information through a badly configured legacy public web application. They reported it through the vulnerability-disclosure process because that’s what you’re supposed to do, rather than treating it as a national-security incident. And then the timing became rather extraordinary. The story became public while Anthony Albanese was in New York, at the same time Australia was launching its campaign for a UN Security Council seat and the PM was talking extensively about AI, digital safety, global AI governance and the economic opportunities of AI. Suddenly this fairly obscure incident with a legacy Medicare statistics website became an international example of autonomous AI systems refusing to “take no for an answer”. I’m not suggesting there’s some conspiracy here, or that the government deliberately manufactured the incident. But I do wonder whether we’re seeing a storm-in-a-teacup effect produced by timing. Perhaps OpenAI’s apparently nonchalant original response wasn’t reckless at all. Perhaps they thought the specific incident was technically pretty boring, while the Australian political environment happened to make it an unusually useful example of a much bigger issue. Conversely, perhaps OpenAI knows something about the agent’s behaviour that hasn’t yet been disclosed, and that’s why its own misalignment investigation flagged the run in the first place. For me, the two things I most want released are: The actual agent action/reasoning trace around the Medicare access. The reason OpenAI’s retrospective monitoring selected this particular run for human investigation. Those would tell us far more than another argument about whether an AI “hacked Medicare”. I’d be especially interested to hear from people who work on agent observability, AI evals, SOC/SIEM systems or government web infrastructure. How would you detect an autonomous agent accessing something that is technically world-readable but wasn’t intended to be public? And if the Wayback reconstruction is broadly correct, do you consider this a meaningful security breach, an access-control/configuration failure, an AI alignment incident — or some combination of all three? Sources worth looking at: The Record/Recorded Future News’ Wayback Machine reconstruction, the ABC’s incident timeline, and the PM/Services Australia statements. submitted by /u/taotau

Originally posted by u/taotau on r/ArtificialInteligence