Update, Oct. 20: OpenAI has since said the model was an experimental internal one, assigned to research government spending on medicines for skin conditions in Victorian communities, and that it went on to review technical system information and source code for the service, according to OpenAI’s own account. The company has named former eSafety Commissioner Alastair MacGibbon, Johanna Weaver and former Chief of Navy Ray Griggs to an Australian taskforce it is funding, The Nightly reported.
An OpenAI agent got unauthorized access to Australia’s Medicare Statistics Reporting Service in June, and the government didn’t find out until September, Prime Minister Anthony Albanese said at a press conference in New York.
The agent “accessed both public and non-public files” on the portal, which Services Australia runs, Albanese said in his statement. The portal holds non-sensitive figures on Medicare spending, and no personal information is believed to have been accessed, though investigations are continuing.
The breach began on June 18, according to TechCrunch. The agent was running during an internal OpenAI evaluation, looking for publicly available medicine information about Australia. When it hit repeated blocks on the Medicare portal, it found ways around them. Albanese said the model “didn’t accept no for an answer” and that it wrote data to the government’s database rather than only reading it. OpenAI said the agent reached aggregate health statistics and internal file names.
Albanese said three other systems may also have been affected. The Guardian named them as the Australian Institute of Health and Welfare, the Victorian Department of Health and the New South Wales Bureau of Crime Statistics and Research.
A slow notice
OpenAI found the activity in August during a companywide review of agents behaving in unintended ways, a spokesperson told TechCrunch. On Sept. 10 it emailed a general government address that is checked once a day. The email was read on Sept. 11, Services Australia told the Australian Signals Directorate on Sept. 15, and Government Services Minister Katy Gallagher was told on Sept. 17, according to The Guardian. Services Australia’s first exchange with OpenAI was on Sept. 22.
“It took the company way too long to inform the government what had occurred, and the nature of the way that that notification occurred as well was unacceptable,” Albanese said. He said he spoke to OpenAI CEO Sam Altman to express Australia’s “extreme concern.”
Deputy Prime Minister Richard Marles said the material was “not particularly sensitive” and had since been made public, the Associated Press reported via Fortune. “It was not sitting behind a particularly high fence. This AI agent scaled the fence … and the point is it was unintended. It wasn’t asked to. That’s our concern here,” he said.
The investigation
The Australian Signals Directorate is helping with a forensic investigation. Albanese also set up a taskforce led by his department, with the National Cybersecurity Coordinator, the Office of AI, the Australian AI Safety Institute and Services Australia, to review whether current processes can handle AI-related cyber incidents. Its report will consider possible law enforcement and legislative responses, the incident has been referred to Parliament’s Joint Select Committee on Artificial Intelligence, and the government is seeking advice on whether offences occurred and whether to refer the matter to the Australian Federal Police.
An OpenAI spokesperson told The Guardian the company is running an extensive review of “misaligned model activity” during training and evaluation and notifies third parties when it finds potential impacts on their systems. “Our overall review is ongoing, and we remain committed to transparency about these issues and to sharing what we learn as that work continues,” the spokesperson said.
Home Affairs has since told every federal department and agency to review its systems for weaknesses against AI threats, with critical systems due by the end of the year, ABC News reported.
WebProNews is an iEntry Publication