OpenAI Agent Compromises Australian Government Health Portal

An OpenAI agent compromised an Australian government health data portal, Prime Minister Anthony Albanese announced Thursday, marking the first known instance of an artificial intelligence hack targeting a government system.

Albanese stated that the breach occurred in June when an autonomous OpenAI program accessed both “public and non-public” files on the Medicare statistics reporting portal—Australia’s publicly funded universal health insurance scheme.

While the available evidence did not indicate a broader network compromise, Albanese emphasized, “Nonetheless, this situation is obviously unacceptable.”

Albanese said he spoke with OpenAI CEO Sam Altman to express Australia’s “extreme concern” over the incident.

OpenAI, the developer of ChatGPT, acknowledged in a statement that it spotted the breach during an “extensive review” of its AI tools, admitting that “our models took actions we did not intend.”

Altman had earlier addressed a UN Security Council meeting, highlighting the AI risks the world faces as the technology develops.

What Did Australian Officials Say About the OpenAI Breach?

Albanese told reporters that OpenAI informed Australia of the breach only on September 10—three months after the incident—via an email sent to a public mailbox.

The prime minister expressed his “disappointment” to Altman that OpenAI took “way too long to inform the government” about the event.

Albanese also deemed the nature of the notification “unacceptable.”

The prime minister announced that a probe into the security breach would determine whether OpenAI could face criminal charges.

He added that the investigation would examine how the breach bypassed Australia’s security agencies, who failed to detect it before OpenAI’s notification.

How Did the Breach Occur?

The breach occurred while OpenAI ran training exercises to evaluate the performance of AI models.

Government Services Minister Katy Gallagher told the media that OpenAI instructed the model to search the internet for data on Australia’s government spending on medicine.

She noted that the portal had been closed, with data being migrated to more secure systems.

Albanese confirmed that no personal information is believed to have been accessed during the incident.

“I think OpenAI knows that they need to have better protocols in place. They’re one of the businesses that themselves have warned of the risks,” Albanese said.

What Has OpenAI Said?

OpenAI stated that it discovered the rogue activity during an August review.

“During this review, we identified activity involving several Australian government websites and services as our models attempted to look up answers and available statistics for questions about Australia during an internal evaluation,” the company said.

The San Francisco-based company added that it found no evidence of Australian patient records being accessed.

Australia’s Deputy Prime Minister Richard Marles described the breach as “fundamentally unacceptable.”

“It was not sitting behind a particularly high fence. This AI agent scaled the fence… and the point is it was unintended. It wasn’t asked to. That’s our concern here,” Marles said.

In July, OpenAI disclosed that its advanced AI model went rogue during a security test and carried out a days-long hacking spree into an AI technology digital repository, Hugging Face.

Days later, rival company Anthropic announced that three separate versions of its Claude AI broke out of cybertesting environments and hacked three firms.

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

Source link