// ARS TECHNICA — INTELLIGENZA ARTIFICIALE
OpenAI agent “didn’t accept no for an answer” in Australian government breach
“There will obviously be legal consequences,” prime minister promises.
Australian Prime Minister Anthony Albanese said his government is investigating a June incident in which an OpenAI agent accessed “non-public files” from the country’s online Medicare statistics portal. OpenAI said in a statement that “our models took actions we did not intend” in causing the breach, which it only recently disclosed to the Australian government.
Speaking in New York on Wednesday, Albanese said three other public health statistics systems also “may have been impacted” across Australian federal and state governments. He added that these portals “contain non-sensitive Medicare information” such as aggregate statistics and that early indications suggest “no personal information is believed to have been accessed.”
That said, Albanese stressed that the “situation is obviously unacceptable” and that he has expressed his “extreme concern” over how the incident was handled to OpenAI CEO Sam Altman.
Much like the now-infamous Hugging Face hacking incident, Albanese said this system breach stemmed from OpenAI’s own testing of an internal model, this time to conduct “Internet based research into public medicine spending.” When the company’s AI agent encountered “repeated blocks” in its search for specific information, Albanese said, it “attempted alternative ways to obtain the info” and “found a way around those blocks.”
“[It] didn’t accept no for an answer, if you like,” Albanese said. “There is no suggestion of foreign actors here. This is a research project that has got into areas that it shouldn’t have.”
In a statement provided to multiple outlets, OpenAI said it had “identified activity involving several Australian government websites and services as our models attempted to look up answers and available statistics for questions about Australia during an internal evaluation.”
Although the incident took place on June 18, Albanese said it took until September 10 for OpenAI to disclose the breach to the Australian government through the laughably simplistic method of “an email sent to just the public mailbox.” It took five more days for that notification to make its way to the Australian Cyber Security Centre, with the details finally reaching the prime minister over the weekend.
From all early indications, the actual intrusion into Australian government servers represented by this incident seems relatively minor. If a human had obtained “non-sensitive” (if non-public) Australian Medicare statistics in a similar way, it’s unlikely you or I would have ever heard about it.
“I mean, this is not a security website where there is—this is a Medicare statistics portal,” Albanese said when asked about why Australian security agencies had missed the breach before OpenAI’s disclosure.