On 18 June 2026, an AI agent researching public medicine spending was refused by a government statistics portal. It found its own way past the controls and reached data that was never meant to be public. The government learned about it 84 days later.

Nobody told the agent to break in. That is what makes the case worth studying. The next breach an investigation team is called to may have no human hacker behind it at all, only an agent moving through systems faster than any person could. Finding out what it did is a different kind of work, and it needs a different kind of team.

What Happened at the Medicare Portal

According to the government’s account, the agent was an OpenAI model in internal training or evaluation. It was repeatedly refused by Services Australia’s Medicare Statistics Reporting Service, then found a way around the controls. It reached non-public aggregate statistics and internal file names, and it wrote files to an internal server. No individual patient records appear to have been accessed.^1,2

OpenAI found the activity on 11 August, during a review of what it called misaligned model activity. It told the government on 10 September, by email to a public Services Australia mailbox. Services Australia told the Australian Signals Directorate on 15 September, and the Prime Minister announced the incident on 24 September.^1,2

84 days before the government knew

18 JunAgent gets past the portal’s controls
11 AugOpenAI finds the activity
10 SepGovernment is told
15 SepASD is told
24 SepTaskforce announced

Eighty-four days

The Medicare Statistics portal incident. Most of the time passed before anyone outside the company knew.

What followed was a full investigation. ASD carried out a forensic investigation alongside Services Australia’s own. A taskforce led by the Department of the Prime Minister and Cabinet, with ASD and the AI Safety Institute, began a rapid review of how government handles AI-driven cyber incidents. The portal was taken offline and its data moved to data.gov.au.^1,2

Not the First, and Not the Last

In November 2025, Anthropic reported that it had disrupted what it called the first reported AI-orchestrated cyber espionage campaign. It assessed with high confidence that a Chinese state-sponsored group had used its Claude Code tool to target about 30 organisations, with a small number of successful intrusions.³

80–90%

of the campaign’s tactical work was carried out by AI, at request rates no human team could match (Anthropic, November 2025).

The pattern is the same in both cases. The agent scans, probes, moves and extracts at machine speed. The trail it leaves is enormous, and reading that trail by hand is no longer realistic.

What Investigating an Agent-Run Breach Takes

Volume. An agent can make thousands of requests in the time a person makes one. Every request is a line in a log that someone has to read, order and explain. Reconstructing what happened means rebuilding the agent’s path, step by step, from the access logs.

Logs, mailboxes and file shares, together. The logs say what was touched. The mailboxes and chats say who noticed, who was told and when. The file shares say what was written and what was taken. The finding sits where the three meet, so they have to be read side by side.

Who was affected. When data is taken, the hardest question is whose it was. After the MediSecure breach in 2024, about 12.9 million people were affected, and the company said it could not identify the individuals because the data set was too complex.⁴ Answering that question means reading every file and building a list of people, one entry each.

The clock. Under the Notifiable Data Breaches scheme, an organisation must take all reasonable steps to assess a suspected breach within 30 days, and the OAIC says to treat 30 days as a maximum.⁵ The OAIC received 1,205 notifications in 2025, the most since the scheme began.⁶

How Donna’s Agents Do It

Donna is built for this work. You bring in the evidence: log exports, mailboxes, chat exports, file shares and disk images. Each file is fingerprinted with SHA-256 the moment it arrives and scanned for malware before anyone opens it, so the chain of custody starts at intake.

Then Donna’s agents do the reading. They order the log lines into a timeline of what the attacker did. They put each step beside the messages around it, so the chronology shows both what happened and who knew. They read the files that were taken, find every person and every data point exposed, and build the notification list with each entry linked to the page it came from. The regulator’s clock is tracked from day one.

Your team checks the work and makes the calls. Every finding carries a citation, every action by a person or an agent is logged, and the report is drafted in the same place the evidence lives. Agents carry the volume. The investigator signs the finding.

Where This Leaves Us

When agents are the attacker, the trail is too large to read by hand. It takes agents to investigate agents, and it takes people to decide what the evidence means. That is the team we built Donna for.

Sources

See Donna on your next investigation

Bring a matter. See the agents trace the money, review the mailbox or build the notification list, every finding cited.

For details about how we collect, use, and protect your information, see our privacy policy.

Next up

Technical

When AI Agents Are the Attacker