OpenAI AI agent breached Australian govt website, accessed non-public files: Albanese

Australia’s Prime Minister Anthony Albanese on Thursday said an OpenAI artificial intelligence agent gained unauthorised access to an Australian government website in June, prompting a forensic investigation and the setting up of a taskforce to review the country’s response to AI-related cyber incidents.

The incident involved the public-facing Medicare Statistics Reporting Portal, administered by Services Australia.

Albanese said the AI agent accessed both public and non-public files on the portal.

“No personal information is believed to have been accessed at this stage,” Albanese said.

Albanese said the incident began on June 18 when OpenAI’s research team used an internal model to conduct internet-based research into public medicine spending.

After encountering repeated blocks while seeking information, the AI agent found ways around them and gained access to other areas of the portal, he said.

The agent accessed public and non-public information and also wrote files to an internal server, according to Services Australia, Albanese said.

The prime minister said he spoke to OpenAI CEO Sam Altman on Thursday and expressed Australia’s “extreme concern” over the incident.

He also criticised the company for taking too long to notify the Australian government.

Albanese said OpenAI did not notify the government until September 10, when it sent an email to a public mailbox.

Services Australia subsequently reported the notification to the Australian Signals Directorate’s Australian Cyber Security Centre on September 15.

The government will establish a taskforce led by the prime minister’s department to conduct an urgent review of the incident and determine whether existing processes are adequate to deal with AI-related cyber incidents.

The taskforce will include the National Cybersecurity Coordinator, Office of AI, Australian Signals Directorate, Australian AI Safety Institute and Services Australia.

The review will also examine possible law enforcement and legislative responses and inform the government’s planned AI standards legislation, Albanese said.

Albanese said the incident appeared to have resulted from OpenAI’s research activity rather than a state-backed operation.

“This is the company, OpenAI, doing research using artificial intelligence and the agent, frankly, not doing what it was supposed to do,” he said.

He said there was no suggestion of foreign actors being involved and described it as a research project that entered areas it should not have.

The government is also aware of three other systems that may have been affected: the Australian Institute of Health and Welfare, the New South Wales Bureau of Crime Statistics and Research, and the Victorian Department of Health.

Albanese said the relevant state premiers had been informed and would receive cybersecurity briefings.

The incident will also be referred to a parliamentary Joint Select Committee on Artificial Intelligence. The government will seek advice on whether any offences occurred and whether the matter should be referred to the Australian Federal Police.

“Humans must remain in control,” Albanese said, adding that Australia wanted to ensure AI systems worked for people rather than the other way around.