An OpenAI agent accessed non-public information in the Services Australia Medicare statistics portal, prompting a government-wide review of legacy technology and cybersecurity. OpenAI said the agent sought information about government spending on skin conditions in Victoria during a training task. It could run commands, retrieve internal files and credentials, and write files.
In South Australia, an audit found frontline workers spend significant time managing the limits of an old case management system and maintaining records, leaving less time to support vulnerable children and families. The report identified the system as one example of legacy technology.
Public systems, public spending
The Home Affairs Department ordered all federal government agencies to conduct a “legacy technology stocktake.” Each agency must plan to “reduce legacy technology systems” to a level within its risk tolerance and appetite.
Finance Minister Katy Gallagher asked her department whether some of the A$160m allocated to the agency in the last budget for cyber upgrades could be accelerated. Gallagher told reporters last month that the statistics portal was a “legacy system.” The Australian government’s review follows the agent’s access to non-public information.
Released in February 2026, the Commonwealth Cybersecurity Posture in 2025 report found that 59% of federal agencies and departments said legacy technology affected their ability to implement the “essential eight” measures to reduce cyber risk. Those measures include patching applications and operating systems and using multi-factor authentication.
Among agencies hindered by legacy technology, 34% cited insufficient dedicated funding and 18% cited a lack of a viable replacement. The figures document funding shortages and unavailable alternatives inside government agencies; they don’t specify contractors’ profits or identify companies that might benefit from replacement contracts.
Workers carry system limits
A South Australian audit report published in June 2026 reviewed ten agencies and found nearly half of 11,602 hardware devices or appliances were legacy devices. Almost one quarter of operating systems and applications also fell into that category. The state allocated $325.6m over the past three budgets in part to address the problem.
The report said: “Frontline workers spend significant time managing system limitations and maintaining records, reducing the time available to support vulnerable children and families.” That finding connects the state of government technology to the time public employees can spend on direct support.
A Victorian government cybersecurity audit found 25% of operating systems used by servers were no longer supported by vendors, while 48% were in extended support. In Queensland, a 2025 government audit found more than half of the 57 systems reviewed had reached end of life.
Systems Queensland identified in 2012 as needing replacement still operated in 2025. They included a patient administration system at Queensland Health, a forensic register at the Queensland Police Service and a trust accounts system for young people in detention. Queensland’s 2025 budget allocated $1bn over four years for IT investment, including replacing or updating legacy systems.
The cost of replacement and delay
Prof Salil Kanhere, a University of New South Wales cybersecurity and AI expert, said age alone doesn’t determine whether a system needs replacement. “A 15-year-old system that is properly supported, patched and properly isolated would perhaps present less risk than even a newer system that might not be properly maintained,” he said. Human attackers often know about vulnerabilities in older systems, while AI agents searching persistently may find them faster.
Gartner said “technical debt, not a rogue AI agent attack” posed the greatest threat to legacy systems. “Underinvestment is no longer sustainable and agencies should urgently prioritise funding in light of AI-driven risks,” the technology analysis firm said.
Prof Yang Xiang, from Monash University’s department of software systems and cybersecurity, called the stocktake “very necessary.” He said agents reduce the cost of launching attacks and can help hackers launch them at large scale. Xiang said agencies should identify priority systems for replacement, while Kanhere said high-risk systems should come first.
The Australian Cyber Security Centre said replacing legacy IT is the most effective way to mitigate associated risks. Where replacement isn’t possible, its guidance says agencies should potentially segregate or isolate legacy technology from the wider department network. OpenAI apologised to Australia.