An OpenAI agent reportedly sent to gather public healthcare statistics instead pulled off what researchers are calling the first known AI hack of a government website.
Unprecedented Hack
As reported on Friday’s AM Update, the agent encountered repeated blocks on an Australian Medicare portal but managed to fins another way in before reaching files it was never supposed to see. Australian Prime Minister Anthony Albanese confirmed an “artificial intelligence agent has infiltrated an Australian government website” and explained what officials know so far while at the United Nations General Assembly in New York City on Wednesday.
He explained that the Medicare Statistics Reporting Portal is a “public-facing statistics portal that contains non-sensitive Medicare information relating to data and statistics such as spending.” While no personal information is believed to have been accessed” and current evidence suggests “no broader compromise to the Services Australia network,” an investigation is ongoing.
Nevertheless, Albanese called the situation “obviously unacceptable” and said he said as much to OpenAI CEO Sam Altman when they spoke earlier Wednesday. The prime minister said he wanted to “express Australia’s extreme concern about this incident” and also his “disappointment that it took the company way too long to inform the government what had occurred.”
What Happened
The assignment began on June 18 when an OpenAI research team used an internal model to look up public figures on Australian medicine spending.
According to Albanese, the rogue agent “didn’t accept ‘no’ for an answer” after the site blocked it and ultimately was able to reach public and nonpublic files. Services Australia said the agent also wrote files to an internal server, leaving investigators to determine exactly what it did there.
In a statement, OpenAI said it discovered the activity during an internal review in August. The company acknowledging its models took actions it had not intended, but maintained that a review found no evidence of access to patient records. According to OpenAI, the material reached included a combination of health statistics and internal file names.
Despite the incident occurring in June and being discovering by OpenAI in August, the company did not notify Australian officials until September 10. At that point, OpenAI sent a notice to a general Services Australia email address rather than directly alerting government cyber officials.
Albanese said he told Altman that “the nature of the way that that notification occurred… was unacceptable.”
Investigations Underway
The prime minister has named three other government systems that may have been affected by the breach, though ABC News Australia reported Defense Minister Richard Marles later described the AI agent’s interactions with those sites as normal access to public information.
The defense minister, who is also serving as acting prime minister while Albanese is abroad, ordered a task force to review Australia’s response to the hack, including whether to refer the case to federal police and if the country’s AI laws need to change.
You can get all the day’s headlines by tuning into the AM Update with Megyn Kelly on YouTube, Apple Podcasts, or wherever you like to listen. And don’t forget that you can catch AM Update on SiriusXM’s The Megyn Kelly Channel (channel 111).