The OpenAI Medicare breach made headlines as a case of “rogue AI”. Dr Rebecca Johnson, an AI evaluation and governance researcher, rejects that label. On The Part 8A, she tells host Miko Santos that the agent did what its settings allowed. The failure sits with the people at OpenAI who designed the test, chose Australia as the place to run it, and waited weeks to tell anyone. She explains why most AI tests only check whether the model got the right answer, not how it got there. She also covers why Silicon Valley’s values don’t transfer neatly to Australia and why a popular ethics benchmark was built on a Reddit forum. Her argument for policymakers is direct. After the OpenAI Medicare breach, Australia should demand logs of these experiments and the right to run its independent tests on AI models designed with local communities. She says we’re moving too slowly. Key topics & takeaways * Why calling it “rogue AI” shifts blame away from the company that built and tested the agent * The gap between outcome-based testing (did it get the answer?) and trajectory-based testing (did it break through a wall to get there?) * How using Australia as a live test environment reflects values that clash with ours, according to Johnson * OpenAI’s slow notification, sent to a public Services Australia inbox rather than by phone * Johnson’s case for independent, Australian-designed AI evaluations: “Someone checking their own homework” isn’t good enough * Value pluralism, and why Sam Altman’s idea of taking the “median value of the planet” would drown out smaller communities * Bad proxies in AI benchmarks, from a Reddit forum used as a Sources, links & further reading * OpenAI’s agent hacked Australia’s Medicare website, PM Albanese says – Fortune [https://fortune.com/2026/09/23/openai-agent-hacks-australia-medicare-sam-altman-anthony-albanese/] * Medicare Australia: “Extreme concern” over OpenAI breach of health database – CNN [https://www.cnn.com/2026/09/23/business/australia-openai-agent-hack-intl-hnk] * OpenAI says agent hacked Australian government website without being told to do so – CNBC [https://www.cnbc.com/2026/09/24/openai-agent-hacked-australian-government-website-.html] * Medicare hack alert went to inbox checked once a day and took five days to be escalated – SBS News [https://www.sbs.com.au/news/article/openai-agent-hacked-medicare-albanese-reveals/qas79d9ta] * Measuring the Machine: Evaluating Generative AI as Pluralist Sociotechnical Systems – Rebecca Johnson, doctoral thesis [https://arxiv.org/pdf/2604.20545] * World Values Survey – World Values Survey Association [https://www.worldvaluessurvey.org] * Aligning AI With Shared Human Values (the ETHICS dataset) – Hendrycks et al. [https://arxiv.org/abs/2008.02275] * Machine Bias – ProPublica [https://www.propublica.org/article/machine-bias-risk-assessments-in-criminal-sentencing] Content warnings & disclaimers Contains brief strong language (the name of a Reddit forum) and discussion of racial bias in the US criminal justice system. Follow The Part 8A on Spotify and Apple Podcasts so next week’s episode lands in your feed. Truth matters. Quality journalism costs. Your subscription to Mencari directly funds the investigative reporting our democracy needs. For less than a coffee per week, you enable our journalists to uncover stories that powerful interests would rather keep hidden. No corporate influence. No compromises. Just honest journalism when we need it most. Five Key Takeaways * A $250 “curiosity click” on a fake Shark Tank-endorsed investment ad grew into a $2.6 million loss within three months, partly because the scammers used a legitimate-looking 100-point identity check to build trust early on. * Banks let large, unusual transfers through — including $1.1 million in under three hours — because Sylvia had sent money to the same account before, and the pattern wasn’t flagged as new. * Anti-money-laundering reporting obligations sit with government regulators, not with the customer. Sylvia argues that’s the biggest structural gap letting scams slip through. * Australia’s new Scams Prevention Framework is meant to share responsibility across banks, telcos and platforms, but Sylvia says it’s made recovery harder, since victims now have to build a case against multiple large institutions with almost no information of their own. * Sylvia co-founded the Scam Victim Alliance after meeting other seven-figure-loss victims at a 2024 Canberra press conference. The group now runs weekly support sessions and helps survivors through the AFCA complaints process. Detailed Synopsis Content note: this episode discusses financial loss, disputes with banks and, briefly, thoughts of suicide. If any of this affects you, you can contact Lifeline at 13 11 14. The ClickIt started with $250 and a television show. Sylvia was scrolling Facebook in 2019 when she saw an ad for a trading platform claiming a Shark Tank endorsement. She watched the show regularly and recognised some of the people who were quoted in the comments. Out of curiosity, she clicked through and paid $250 to open an account. Worst case, she thought, that’s all she’d lose. The SetupThe platform didn’t ask for real money straight away. It asked for identification: a driver’s licence, proof of address, and a “100-point check”, exactly like opening a bank account. To a finance professional who runs the same checks on her own clients, the process looked like diligence, not danger. She topped up to $10,000 as a starting point. Every step made the platform feel more legitimate. The EscalationOver the following months, the amounts grew. One transfer alone moved $1.1 million in under three hours. Her bank didn’t flag it, because she’d sent money to that account before. By the time Sylvia understood what was happening, she had lost $2.6 million. The FalloutThe public response was harsh. After a news story about her case ran on Facebook, one comment read: “I’m glad she’s not my accountant.” Others suggested that if she had so much money, she must be greedy for wanting more.Sylvia says the loss itself wasn’t the hardest part. It was watching people question her professional judgement and her character at the same time. During the worst of it, she says she thought seriously about ending her life. What kept her going was the thought of the friends who had lent her money and trusted her to pay it back. Finding Each OtherSylvia lobbied on her own for years, with limited effect. That changed in 2024, when she met a group of fellow scam victims at a press conference in Canberra, supported by an advocate she names as Debbie Pope. Between just three people in that room, total losses exceeded $5 million.Sylvia says standing with people who understood exactly what she’d been through, without judgement, was the moment the isolation started to lift. That meeting became the starting point for the Scam Victim Alliance. The Fight With the BanksSylvia is currently in disputes with three of Australia’s big four banks: the one she sent money from, the one that handled a mortgage refinance during the scam, and the one that held the scammer’s receiving account. She estimates she’s spent around $250,000 on legal fees, with no resolution.She argues that anti-money-laundering reporting obligations are owed to the government, not the customer, and that the current system leaves victims with almost no leverage when something goes wrong. Building the AllianceThe Scam Victim Alliance is volunteer-run. It holds a weekly online support session every Wednesday night, open to victims of any scam type and any size of loss, from a few thousand dollars to the $12 million case Sylvia says is the largest she’s aware of. The group connects people with a psychologist where needed and helps them collect evidence for the AFCA complaints process, the formal channel for disputing a bank or financial firm’s decision. Her AdviceSylvia’s message is blunt. If someone you don’t know calls you every day, that’s unusual, not normal relationship-building. If you’re being pushed to act urgent… This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit theregisterau.substack.com/subscribe
