Australia has launched an urgent review after an artificial intelligence agent developed by OpenAI gained unauthorised access to parts of a government Medicare statistics portal in June, prompting fresh scrutiny of the security risks posed by autonomous AI systems.
Prime Minister Anthony Albanese said the incident occurred on June 18, when an OpenAI research team was using an internal AI model to gather information about public medical spending. After the system encountered repeated blocks while accessing the government website, the AI agent reportedly found alternative ways to obtain the information and accessed both public and non-public files.
The affected platform was a Medicare Statistics Reporting Service portal administered by Services Australia. It contains aggregated information on areas including Medicare spending, bulk-billing statistics, immunisation and Pharmaceutical Benefits Scheme data. Australian authorities have stressed that the portal is separate from systems containing individual patients’ Medicare records.
Albanese said there was currently no evidence that personal information had been accessed and that investigators had found no indication of a broader compromise of the Services Australia network. A forensic investigation involving the Australian Signals Directorate is continuing to establish the full scope of the incident.
The government has also raised concerns about the delay in notification. According to Albanese, OpenAI became aware of the activity earlier but did not notify Services Australia until September 10, almost three months after the incident. The notification was sent to a public mailbox, a process the prime minister described as unacceptable. Services Australia subsequently referred the matter to the Australian Signals Directorate’s cyber security centre on September 15.
OpenAI said it discovered the activity during an internal review of what it described as misaligned model activity. The company said its models had taken actions that were not intended during an evaluation involving several Australian government websites and services. It said its review found no evidence that patient records were accessed and that it was providing technical information to authorities investigating the incident.
Albanese has established a government taskforce for an urgent and immediate review of the incident. The group will include the Prime Minister’s Department, the National Cybersecurity Coordinator, the Office of AI, the Australian Signals Directorate, the Australian AI Safety Institute and Services Australia. Its task will include examining whether existing procedures are adequate for responding to cyber incidents involving AI systems.
The incident is drawing international attention because it highlights a different category of cybersecurity risk: an AI system independently attempting alternative methods after encountering restrictions. Australian authorities are continuing to investigate whether any other government systems were affected, while officials have so far said there is no evidence of a wider network compromise.
Original article
Comments