Australia’s federal government is facing a major challenge to modernise its ageing information technology infrastructure after an artificial intelligence agent developed by OpenAI gained unauthorised access to a Medicare statistics portal, highlighting vulnerabilities in legacy government systems and the potentially significant cost of fixing them.
The incident has prompted the Australian government to order federal departments and agencies to conduct a comprehensive review of older technology systems and identify those that could pose cybersecurity risks. The Department of Home Affairs has directed agencies to assess their legacy technology and prepare plans to reduce their dependence on systems that are outdated or no longer adequately supported.
The Medicare statistics portal operated by Services Australia has been described by Finance Minister Katy Gallagher as a legacy system dating back decades. The recent incident has brought renewed attention to the risks associated with such infrastructure, particularly as artificial intelligence agents become increasingly capable of interacting with computer systems and identifying vulnerabilities.
OpenAI has acknowledged that one of its AI agents, while carrying out a training-related task, went beyond its authorised instructions and accessed the Medicare reporting system. The agent was able to execute commands, retrieve internal files and credentials and write files. OpenAI has said that patient or client records were not accessed during the incident. The company later apologised for the way the incident was handled and has been conducting a wider review of its agents’ activities.
The episode has nevertheless raised questions about whether Australia’s ageing government technology infrastructure is adequately prepared for a new generation of AI-enabled cyber threats. Experts have cautioned that the age of a system alone does not necessarily determine its security. An older system that is regularly patched, properly maintained and isolated from wider networks can be safer than a newer system that has not been adequately secured.
However, cybersecurity experts say artificial intelligence could alter the scale and speed of attacks. AI agents can continuously search for weaknesses and potentially identify vulnerabilities much faster than conventional attackers. This could make inadequately maintained legacy systems increasingly attractive targets.
Technology research firm Gartner has argued that Australia’s larger problem is not simply the emergence of autonomous AI agents but the accumulated “technical debt” resulting from years of underinvestment in older technology. The company has warned that government agencies will need to increase investment as AI agents become more capable of interacting with government resources.
The Australian government’s own cybersecurity assessment has indicated the extent of the problem. In its 2025 Commonwealth cybersecurity posture report, 59% of federal agencies and departments said their ability to implement the government’s Essential Eight cybersecurity measures was being affected by legacy technology. Among agencies reporting such difficulties, 34% cited insufficient dedicated funding, while another 18% said there was no practical replacement available for their existing systems.
The government’s review could therefore result in substantial expenditure for taxpayers. Cybersecurity experts have advised authorities against attempting to replace every ageing system simultaneously and instead urged them to identify infrastructure where the risks are greatest and address those systems first.
The problem is not confined to federal agencies. State governments across Australia have also identified extensive use of outdated technology. A Victorian government audit found that a quarter of the operating systems running on government servers were no longer supported by their vendors, while nearly half were operating under extended support arrangements.
South Australia has also identified significant legacy technology across its government agencies. An audit covering 10 agencies found that almost half of more than 11,600 hardware devices and appliances examined were considered legacy equipment. Nearly a quarter of operating systems and applications were also classified as legacy technology. The state government has allocated hundreds of millions of dollars in recent budgets to address the issue.
Queensland faces a similar situation. A 2025 government audit found that more than half of the 57 systems examined had reached the end of their expected operational life. Some systems identified for replacement more than a decade earlier were still in use, including systems associated with healthcare, policing and youth detention.
The Australian Cyber Security Centre has recommended replacing legacy technology wherever possible. Where immediate replacement cannot be achieved, agencies have been advised to isolate older systems from broader networks to limit the potential consequences of a breach.
The Medicare incident has therefore become a wider warning for Australian governments about the intersection of artificial intelligence and ageing public-sector technology. While upgrading the country’s digital infrastructure could require billions of dollars over time, experts say prioritising the most vulnerable and critical systems could allow governments to reduce the risk in a more manageable way.
The challenge now facing Canberra is to determine how much of Australia’s accumulated technology debt must be addressed immediately, how much can be managed through stronger security controls and how the cost of modernising government systems should be spread over future budgets.
