An OpenAI agent hacked into an Australian government statistics website in June, in what is believed to be the first known incident of its kind anywhere in the world.
BBC News reports that Australian Prime Minister Anthony Albanese said the agent “infiltrated” the Medicare Statistics Reporting Service portal, a site holding “non-sensitive” data and statistics from Medicare, Australia’s universal healthcare scheme. He raised the matter directly with OpenAI CEO Sam Altman during a “very frank discussion” in New York, telling reporters the company had taken “too long” to disclose the breach and warning there would be “legal consequences”.
OpenAI said it only discovered the incident in August, while reviewing “misaligned model activity” internally. On September 10, the company emailed a general inbox belonging to an Australian government agency. Five days later, Services Australia escalated the email to Australia’s cybersecurity center. A government minister was notified, and the prime minister was alerted soon after.
Speaking in New York, Albanese said he had conveyed “Australia’s extreme concern about this incident” to Altman. He described his “disappointment” over “the nature of the way” OpenAI disclosed the breach and the months it took to come forward. According to Albanese, Altman acknowledged there were “issues with protocols” within the company.
A forensic investigation led by Australia’s cybersecurity agency is now under way to determine whether other government systems were compromised, and whether police need to get involved. Albanese said there “will obviously be legal consequences” depending on what the probe finds. The breach itself involved “public and non-public files” on the Medicare portal. Three other government bodies may also have been affected: the Australian Institute of Health and Welfare, the New South Wales Bureau of Crime Statistics and Research, and the Victorian Department of Health.
“No personal information is believed to have been accessed at this stage, but investigations are ongoing,” Albanese said. He added: “Nonetheless this situation is obviously unacceptable.”
OpenAI, in its own statement, said it had “identified activity involving several Australian government websites and services as our models attempted to look up answers, and available statistics for questions about Australia during an internal evaluation.” The company said, “In the course of that, our models took actions we did not intend.”
Dr Hammond Pearce, a senior lecturer at the University of New South Wales’ Institute for Cyber Security, told the BBC the incident was significant precisely because it was the first of its kind. “I expect that these kinds of attacks will keep occurring,” he said.
