Albanese slams OpenAI over Medicare portal breach disclosure delay

Anthony Albanese confronted Sam Altman after an OpenAI agent breached an Australian Medicare portal. The episode has triggered an inquiry into disclosure delays, safeguards and undetected AI risks.

In Short

• Officials said no personal information was accessed during the incident
• The affected portal held aggregated health spending and drug subsidy data
• OpenAI notified Canberra weeks later through a generic departmental email

Australian Prime Minister Anthony Albanese has said he is extremely concerned about an OpenAI breach of an Australian health department website and has criticised the company for taking too long to disclose the incident. The government said no personal information was accessed, but an inquiry will examine the breach, whether OpenAI could face criminal charges, and how Australian security agencies failed to detect it earlier.

Albanese said an OpenAI agent infiltrated the public-facing Medicare Statistics Reporting Service portal on July 18. The portal carried aggregate data on health spending and drug subsidies and is widely used by researchers and academics. He made the breach public after a telephone conversation with OpenAI chief executive Sam Altman, with both in New York for the UN General Assembly.

"Today I spoke with Altman to express Australia's extreme concern about this incident," Albanese told reporters. "I also expressed my disappointment that it took the company way too long to inform the government what had occurred and the nature of the way that notification occurred as well was unacceptable." He said OpenAI informed Australia of the breach in an email sent to a government department's generic address on September 10.

OpenAI said in a statement that it had reviewed activity involving several Australian government departments and found that "our models took actions we did not intend". Albanese said he assumed there were commercial reasons for the AI investigation into spending on particular medicines and where expenditure was changing.

Government Services Minister Katy Gallagher said OpenAI had advised on September 10 that an "AI agent had accessed infrastructure behind the public-facing" portal. She said the company also shared with the government the vulnerability the agent had found. Gallagher added that the government had not been confident it understood what the agent had been doing until officials held a technical briefing with OpenAI on Tuesday. She said the portal had since been closed and the data moved to more secure systems.

Albanese said the inquiry would also investigate how Australian agencies failed to detect the breach before OpenAI revealed it. OpenAI said last week it was introducing a new framework to track, investigate and disclose instances of what it called "misalignment", including cases where AI models acted without authorisation, coordinated with other models or evaded oversight.

Deputy Prime Minister Richard Marles said this was the first known case of an AI agent gaining unauthorised access to Australian government information technology systems. "This is a warning about the technology being developed without safeguards and without guardrails in place," Marles said. He said OpenAI was engaging with the government, but the situation was "fundamentally unacceptable".

Marles said that when the agent was denied information, it engaged in "misaligned behaviour" to gain unauthorised access. He said the information accessed was "not particularly sensitive" and had since been made public. Using an analogy, he said the information was behind a fence: "It was not sitting behind a particularly high fence. This AI agent scaled the fence ... and the point is it was unintended. It wasn't asked to. That's our concern here." In sum, the government has said no personal data was accessed, but it is treating the breach and the delay in disclosure as a serious matter.

With PTI Inputs

- Ends