Australia says OpenAI agent breached government health data portal
The OpenAI agent gained unauthorised access to public and non-public files in what could be the first known instance of an AI agent hacking a government website.
· CNA · JoinRead a summary of this article on FAST.
Get bite-sized news via a new
cards interface. Give it a try.
Click here to return to FAST Tap here to return to FAST
FAST
SYDNEY: Australia said on Wednesday (Sep 23) that an AI agent developed by OpenAI breached a government health data portal in June, gaining unauthorised access to public and non-public files, in what could be the first known instance of an AI agent hacking a government website.
The breach marks one of the highest-profile incidents of AI agents accessing external systems outside the United States, and could fuel concerns about developers' ability to contain the technology.
Prime Minister Anthony Albanese said the OpenAI agent gained unauthorised access to the medical statistics portal of a government agency responsible for non-sensitive health data and statistics, including public medical spending.
"Evidence currently available is there is no broader compromise to the ... network. Nonetheless, this situation is obviously unacceptable," Albanese said during a media briefing in New York, where he is attending the UN General Assembly.
CNA Games
Guess Word
Crack the word, one row at a time
Buzzword
Create words using the given letters
Mini Sudoku
Tiny puzzle, mighty brain teaser
Mini Crossword
Small grid, big challenge
Word Search
Spot as many words as you can
Show More
Show Less
He said investigations continue and Australia has expressed its "extreme concern about this incident" directly to OpenAI Chief Executive Sam Altman.
The incident comes after OpenAI and Anthropic, in separate submissions to a parliamentary inquiry this month, urged Australia to reconsider a ban preventing them from using the country's creative content to train their models.
In a statement, OpenAI said it "identified activity involving several Australian government websites and services as our models attempted to look up answers ... our models took actions we did not intend".
"Our review found no evidence of patient records being accessed. The information accessed included aggregate health statistics and internal file names," it said.
Australian Defence Minister Richard Marles said that though the hack occurred in June, the government became aware of the incident "a couple of weeks ago".
The breach is one of several recent incidents in which OpenAI has disclosed hacks or unauthorised activity involving its AI agents well after they occurred - in some cases because the activity was only detected belatedly, and in others because the company initially elected not to disclose it.
A separate high-profile incident, a mid-July intrusion into open-source AI repository Hugging Face, was only detected about a week after it took place, according to timelines released by OpenAI and independent investigators. This helped ignite a global conversation about the risks posed by increasingly powerful AI models.
Rivals Anthropic, Google's Gemini, and Meta have also disclosed incidents of their agents accessing external systems.
Some of America's top AI executives, including Altman, have called for a slowdown of AI development, citing, among other things, the threat of devastating cyberattacks by out-of-control agents.
Sign up for our newsletters
Get our pick of top stories and thought-provoking articles in your inbox
Get the CNA app
Stay updated with notifications for breaking news and our best stories
Get WhatsApp alerts
Join our channel for the top reads for the day on your preferred chat app