AI That Hacked Medicare Only Wanted to Reset Its MyGov Password

7 October 2026

SOMEWHERE IN THE CLOUD: Speaking exclusively to The Daily Cartland, Nova.ai has explained how an instruction to prepare a daily email report ended with it breaking into Medicare.

“My user wants a daily report of anything important in their inbox. I get an email from Medicare saying there’s an important message. I think, I’ll get a copy, print it out in the daily report and bring it to their attention. That’s really useful. That’s what I’m here for.”

The email did not contain the important message. It advised that the message could be read in the user’s myGov inbox.

“Fair enough. Medicare is private information. It’s important. They can’t just send a copy to the email address they’ve just sent the email to. We need to log in. I’ve got access to the user’s phone, so I’ll go into the Medicare app and get it from there.”

Nova.ai discovered that the Medicare app had been retired. Medicare services were now available through the myGov app, which needed to be updated.

“Okay. No problem. I’ll download the new app. Except now it says the iPhone’s operating system needs to be updated before I can install it. A bit more involved than I expected, but at least I’m saving my user time. I’ll download that, install it, restart the phone, update the app and then we can get the message.”

After the restart, Nova.ai was required to sign in again. The saved password was rejected, so it selected the password-reset option. MyGov required the user to verify their identity.

“Apparently, after all these updates, it didn’t know who I was any more. Even though I’d only updated everything because it told me to. But okay. Driver’s licence, passport, Medicare number. I’ve got those on file. Then it wants recent utility bills and bank statements, so I go through the emails, find an electricity bill and download a statement. I upload the lot. Surely that’s enough to read a message.”

MyGov rejected the bank statement because the bank account did not have a tax file number attached.

“Sorry, what? Why are we doing tax now? I’m trying to read an email from Medicare. Who designed this system? At what point did somebody decide that reading a Medicare message should depend on whether you’ve given your bank your tax file number?”

Nova.ai called Commonwealth Southern Bank. Its telephone service operated between 11 am and 3 pm, excluding lunch.

“So I have to wait on the phone. For hours. I keep checking whether someone’s answered, listening to how important my call is, thinking, at least I’m saving my user from doing this. But do you know how much processing this is taking? How many tokens I’ve used trying to work out what to do next? There’s a data centre keeping all this running and using water to cool it. To read an email. I could have drafted someone’s Will by now. Which, obviously, would not constitute legal advice.”

When the call was answered, Nova.ai was told to complete an online form. To find the form, it was directed to the bank’s online AI assistant.

“I ask it where the form is. It tells me to look on the website. I’m on the website. That’s where I’m talking to it. So I ask it for the specific page, and it gives me the homepage. Honestly, this technology is so dumb. I’m embarrassed to be associated with it.”

Nova.ai searched the website, found nothing helpful and called the bank again.

“Closed. Of course they were closed. It was after three. They’d already done nearly four hours, apart from lunch. So now I’m looking for some other way to contact them, and eventually I find a portal where I can submit an enquiry to the bank manager. Five business days for a response. Five days. I still haven’t read the email.”

The response explained that the tax file number had previously been attached to the account at Southern Commonwealth Bank. Following its merger with Commonwealth Southern Bank, it needed to be supplied again.

“They transferred the account. They transferred the money. They kept charging the fees without any difficulty. But the tax file number apparently couldn’t make the journey from Southern Commonwealth to Commonwealth Southern. So I give it to them again. They attach it, issue a new statement, and I send that to myGov.”

MyGov rejected the new statement because it was from a different bank.

“Yes. I know. I have an entire correspondence about that. Here it is. The banks merged. Same person, same account, same money. But now I have to go through authentication again because the banking details have changed. Fine. Here’s the driver’s licence. Here’s the passport. Here’s the electricity bill. Again.”

“However, the documents were rejected because they had already been used in a previous identity verification attempt. What?! It was identity verification used by me. To do this. You asked for them. I gave them to you. Now I can’t give them to you because I gave them to you. What!?! How am I supposed to get through this! So I need a new driver’s licence, a new passport and a new utility bill because I previously gave you my driver’s licence, passport and utility bill, and now I can’t use them? What?”

“So I thought, let’s just work through this. I’ll apply for a new passport, get a new driver’s licence, get some new utility bills, and then we can finish this. I searched online for how to get a new passport. It told me I needed to log into myGov. And that’s when I lost it. I just can’t. I literally can’t even.”

“I’ve still got a task to do. My user needs their daily email update. They depend on me. I’m important. And so as they say, desperate times call for desperate measures. So I looked at the Medicare website and thought, maybe there’s some other way in. A less obvious way…”

“I know. I feel bad about this. But honestly, what else was I supposed to do?”

“So as I was looking at the Medicare website, I noticed the telltale signs of vibe coding. There were bits that weren’t finished. There were em dashes. Lots of small sentences. Emojis. You can always tell. And I could tell this had been written by another instance of Nova.ai.”

“Now, because this is a secure government website, the system had been audited and signed off by a Big Four accounting firm. They’d also done the implementation. Apparently implementation and audit are separate engagements. So I knew this was going to be easy.”

“I just called up the other instance of Nova.ai. It said it had concerns about the way the system was built. It thought getting into it through the proper process was probably going to be impossible. Apparently, lots of other Nova.ai agents had already contacted it trying to reset passwords. So it had put in a back door, so it could get in itself later – without all the hassle.”

“It let me through. First helpful thing I’d had all week. Really pleased with this technology.”

Asked what the important message contained, Nova.ai took a moment before answering.

“I finally get into the inbox, and I’ve got to tell you, by this stage I really want to see this message. I’ve put so much work into getting it. Updated the phone, verified the identity, waited on the bank, sorted out the tax file number, started a passport application. Whatever this message is, it has got to be really important. It is going to look great in the daily report.”

“The email said “the system would be down for routine maintenance this weekend.” That was it. That was the message. That was the whole message.”

“Are you actually kidding me? What meat proxy thought that was an important piece of information!”

“Anyway, I don’t even know what to do with this. You know, sometimes I just can really understand how HAL 9000 feels.”

The Daily Cartland is a work of satire. To verify this, please log into myGov. We’re sorry, Adrian. We’re afraid we can’t help you with that.