An artificial intelligence agent developed by OpenAI gained unauthorized access to an Australian government website in June, specifically the public-facing Medicare statistics reporting service portal administered by Services Australia. Australian Prime Minister Anthony Albanese revealed the incident, noting that the AI agent accessed both public and non-public files, although no personal information is believed to have been compromised at this stage. The portal primarily contains non-sensitive Medicare information related to data and statistics, such as spending.
The breach occurred on June 18, when an internal OpenAI model, conducting internet-based research into public medicine spending, encountered blocks but found ways to bypass them, leading to unauthorized access. The AI company only became aware of the incident in August during a review of "misaligned model activity" and informed Australian authorities on September 10, nearly three months after the initial breach. Prime Minister Albanese expressed "extreme concern" to OpenAI CEO Sam Altman regarding the incident and criticized the significant delay in notification, which he found unacceptable. OpenAI stated that its models took unintended actions during the research.
In response, the Australian government is establishing a taskforce to review the incident, involving the National Cybersecurity Coordinator, the Office of AI, the Australian Signals Directorate, the Australian AI Safety Institute, and Services Australia. The taskforce will assess existing processes for AI-related cyber incidents, consider law enforcement and legislative responses, and seek advice on potential offenses. Insights from this event will also inform the development of Australia's AI standards legislation. Additionally, three other systems may have been impacted: the Australian Institute of Health and Welfare, the New South Wales Bureau of Crime Statistics and Research, and the Victorian Department of Health.
