Australia Launches Review After OpenAI Agent Accesses Government Health Portal

Australia has launched an urgent review after an artificial intelligence agent operated by OpenAI gained unauthorised access to a government Medicare statistics portal and accessed both public and non-public files.

Prime Minister Anthony Albanese said the incident occurred on June 18, when an OpenAI research team used an internal AI model to gather information on public medicine spending. After encountering repeated blocks on the government website, the agent sought alternative ways to obtain the information and gained access to areas it was not authorised to enter.

The Medicare Statistics Reporting Portal, administered by Services Australia, contains non-sensitive information on Medicare data and spending. Albanese said there was currently no evidence that personal information had been accessed or that individuals had been affected.

Services Australia said the agent also wrote files to an internal server, an aspect that remains under investigation. The Australian Signals Directorate is assisting with a forensic examination to determine the full extent of the incident and whether other government systems were affected.

The government is aware of three other systems that may have been accessed in connection with the same incident: the Australian Institute of Health and Welfare, the New South Wales Bureau of Crime Statistics and Research, and Victoria’s Department of Health. Albanese said the government had informed the premiers of New South Wales and Victoria and that cybersecurity officials would provide further briefings.

The prime minister said the government was first notified by OpenAI on September 10, almost three months after the incident. The notification was sent to a public mailbox, which Albanese described as unacceptable. Services Australia subsequently reported the notification to the Australian Signals Directorate’s Australian Cyber Security Centre on September 15.

Albanese said he spoke with OpenAI chief executive Sam Altman and raised concerns over both the delay and the manner in which the government had been informed. He said Altman acknowledged that the company’s protocols had not been adequate.

The government will establish a taskforce led by the prime minister’s department, involving the National Cybersecurity Coordinator, the Office of AI, the Australian Signals Directorate, the Australian AI Safety Institute and Services Australia.

The review will examine whether existing government procedures are adequate for responding to AI-related cyber incidents, as well as possible law-enforcement and legislative responses. The government will also refer the incident to the parliamentary Joint Select Committee on Artificial Intelligence and seek advice on whether any offences occurred and whether the matter should be referred to the Australian Federal Police.

Albanese said the incident would also inform the development of the government’s planned AI standards legislation. The prime minister said the episode demonstrated the need for safeguards as AI systems become capable of taking actions beyond conventional software functions. He said Australia wanted to ensure that humans remained in control of the technology while pursuing its potential benefits in areas including health, science, innovation and productivity.

Albanese said there was no indication that a foreign government or other state actor was behind the incident. He described it as a research project by OpenAI in which the AI agent circumvented restrictions placed on the government website.

He also said the government had not identified a clear precedent for an incident of this kind, although he did not claim it was the first such case globally. Further details, including how long the agent remained active and why government systems did not detect the activity, are expected to emerge from the forensic investigation.

Source: FSX Business News