An artificial intelligence agent operated by OpenAI breached Australia’s Medicare statistics portal, accessing non-public government data about spending on skin conditions in Victoria. The incident wasn't a sophisticated cyberattack. It was a training task gone wrong. But it's exposed a far costlier problem: the Australian government is running critical services on decades-old technology that can't be patched, secured or defended against modern threats.
Finance Minister Katy Gallagher confirmed the statistics portal is a legacy system dating back decades. In response, the Home Affairs Department ordered all federal government agencies to conduct an immediate "legacy technology stocktake," requiring each to map old systems and plan replacements. Gallagher asked her department whether it could accelerate some of the A$160m allocated for cyber upgrades in the last budget.
The scale of the problem is staggering. A Commonwealth Cybersecurity Posture report released in February 2026 found that 59% of federal agencies and departments said legacy technology directly hindered their ability to implement basic security measures like patching applications and using multi-factor authentication. Among those agencies, 34% blamed insufficient dedicated funding, while 18% said no viable replacement even exists.
The Real Threat Isn't Rogue AI
Cybersecurity experts agree the OpenAI breach represents a symptom, not the disease. Gartner, the technology analysis firm, cautioned that "technical debt, not a rogue AI agent attack" poses the greatest threat to legacy systems. The firm warned that "agentic AI's interactions with government resources will greatly increase," making underinvestment "no longer sustainable." Agencies must urgently prioritize funding in light of AI-driven risks.
Prof Salil Kanhere from the University of New South Wales offered context: a system's age alone doesn't determine risk. "A 15-year-old system that is properly supported, patched and properly isolated would perhaps present less risk than even a newer system that might not be properly maintained," he said. The real vulnerability comes from systems that aren't maintained—where vendors have stopped releasing security updates and nobody bothers to patch them anyway.
But AI changes the equation. Prof Yang Xiang from Monash University's cybersecurity department emphasized that AI agents search persistently for weaknesses, far faster than human attackers. "The cost to launch an attack is much reduced and with the help of agents, it is fairly easy for the hacker to launch a very large scale attack against any systems," he warned.
State Governments Face the Same Crisis
This isn't a federal problem alone. Victoria's cybersecurity audit found 25% of server operating systems are no longer supported by vendors, with another 48% in extended support only. A South Australian audit published in June 2026 reviewed ten agencies and discovered nearly half of 11,602 hardware devices were legacy equipment. Almost a quarter of operating systems and applications were classified as legacy.
The South Australian Department for Child Protection's case management system is more than 15 years old and has limited vendor support. The audit found frontline workers spend substantial time managing system limitations, reducing time available to support vulnerable children and families. Over three budgets, South Australia allocated $325.6m partly to address legacy technology—and the problem persists.
Queensland's situation is worse. A 2025 government audit found more than half of 57 systems reviewed had reached end of life. Remarkably, systems Queensland identified as needing replacement back in 2012 still operated in 2025. They include a patient administration system at Queensland Health, a forensic register at Queensland Police, and a trust accounts system for young people in detention. Queensland's 2025 budget allocated $1bn over four years for IT investment, but that's money that could've gone to schools, hospitals or tax relief.
The Cost of Delay
Experts differ on strategy but agree on urgency. Kanhere suggested a systematic approach: "You do the high risk stuff first, I think it is absolutely needed, and then put the perimeter around other systems." Xiang emphasized the need to identify priority systems for replacement. The Australian Cyber Security Centre has stated that replacing legacy IT is the most effective way to mitigate associated risks. Where replacement isn't possible, agencies should segregate systems or isolate them from wider networks to restrict access.
The OpenAI breach serves as a reminder that waiting for catastrophe to justify spending is policy malpractice. These systems have deteriorated for years. The fixes have been known for years. Queensland identified problems 14 years ago and did nothing. Now taxpayers will foot an enormous bill—not to upgrade capabilities, but simply to restore basic security that should never have been allowed to lapse.
Why This Matters:
Government IT debt creates a peculiar fiscal problem: the cost of inaction compounds invisibly until it suddenly becomes catastrophic and non-negotiable. Federal and state agencies face a choice between modernizing now at planned expense or waiting for breaches that force emergency spending at premium rates. The OpenAI incident cost nothing—the attacker found information but didn't exploit it. The next breach might cost far more in remediation, legal liability and citizen harm.
The consequences go beyond budgets. Legacy systems constrain government effectiveness. Frontline workers spend hours managing workarounds instead of serving citizens. Police can't access integrated forensic data. Child protection workers lose time to system limitations. These aren't IT department problems; they're delivery failures that harm the people government serves. The stocktake is necessary. So is the funding. The question is whether Australian governments will treat this as an urgent priority or keep delaying while AI agents, hackers and time itself erode what's left of these aging systems.