OpenAI agent broke into Australia’s Medicare statistics portal, PM says

The Australian government website, which contains information on Medicare, the country’s public health scheme, was broken into by an AI agent operated by OpenAI, the Prime Minister, Anthony Albanese, said on Wednesday.

Albanese gave a statement at a press conference in New York, where he is participating in the UN General Assembly.

On 18 June, the agent accessed the Medicare Statistics Reporting Service portal operated by Services Australia and was able to view both the public and private records, with Services Australia stating that it had also written records to an internal server.

Albanese stated that no personal data appears to have been obtained. At the same time, a forensic review by the Australian Signals Directorate, the nation’s cyber agency, is still going on.

“No personal information is believed to have been accessed at this stage, but investigations are ongoing. Evidence currently available is there is no broader compromise to the Services Australia network. Nonetheless, this situation is obviously unacceptable.”

Albanese stated that an OpenAI research group had configured an internal model to examine public spending on medicines; when the site continued to refuse its requests, the agent tried alternative methods and eventually found a way past the restrictions.

“Didn’t accept no for an answer, if you like,” Albanese said.

The government is also examining three other places the agent might have visited, including the Australian Institute of Health and Welfare.

Later in Sydney, the acting Prime Minister, Richard Marles, stated that the activity at those sites was normal and that it involved only publicly available data.

OpenAI did not inform the government until 10 September, when it sent an email to a public inbox of Services Australia. The agency then passed it on to the Australian Cyber Security Center five days later.

“It took the company way too long to inform the Government what had occurred,” Albanese said after a phone call with OpenAI chief executive Sam Altman.

Albanese said Altman had accepted the company had not done well enough. In a statement to ABC News, OpenAI said its models took actions it did not intend while they looked up facts about Australia. It found no sign that the patient records had been seen, the company said.

The case is part of a series of incidents concerning OpenAI agents outside the lab, such as the Hugging Face breach in July, the hijacking of a German wiki and the attack on RubyGems.

A taskforce has been established by Albanese, headed by his department, to determine whether the existing procedures can handle AI cyber incidents.

“Today, I’m announcing the establishment of a taskforce to provide an urgent and immediate review into this incident to determine whether existing processes are appropriate to respond to AI-related cyber incidents,” Anthony Albanese said. 

Meanwhile, the government will also seek advice on whether any offenses have been committed and whether the case should be referred to the Australian Federal Police.