// TOM'S HARDWARE US — HARDWARE & GADGET
OpenAI agent got into Australia's Medicare stats portal with 84-day notification delay
OpenAI's notification landed in a government inbox only checked "once a day."
When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.
Australia has ordered an “urgent and immediate review” after saying an OpenAI agent discovered a way around blocks on its Medicare statistics portal, BBC News reported. Prime Minister Anthony Albanese made the announcement at the UN General Assembly in New York, referring to a hack that happened in June. OpenAI became aware of the hack in August but did not report it to the government agency’s public inbox until September.
The report says it is “believed to be the first known breach of a government system by rogue AI agents.” Albanese stated it took OpenAI “way too long to inform the government,” and OpenAI said “our models took actions we did not intend.”
The breached portal, Australia’s Medicare Statistics Reporting Service, run by Services Australia, is a public-facing site that contains “non-sensitive Medicare information,” Albanese said. He said OpenAI’s research team used an internal model to research public medicine spending and that the agent hit and sidestepped repeated blocks, eventually reaching “both public and non-public files.” Services Australia has also stated that the agent wrote files to an internal server, according to the PM, but that claim remains under investigation.
OpenAI described the work as an “internal evaluation” with accessed material including “aggregate health statistics and internal file names” but said it found no evidence of patient records being accessed. It is also “providing technical information” to support the investigations.
OpenAI’s agent reportedly first accessed the portal on June 18. The company became aware of this during a review in August. On Sept. 10, 84 days after first access, it emailed Services Australia via its public mailbox. Five days later, the government department reported it to the Australian Cyber Security Centre, part of the Australian Signals Directorate (ASD).
Albanese said OpenAI CEO Sam Altman acknowledged that the company’s protocols “were not up to scratch here.” Katy Gallagher, the minister for the public service, also admitted that inbox handling could be managed better, with it only being “looked at once a day” and being prone to receiving hoaxes.
On Sept. 16, OpenAI published “Our framework for reporting model misalignment” with six reports, just six days after the email. The outlet observes that the blog post didn’t appear “to mention this incident,” despite OpenAI being aware by August. OpenAI’s framework appears to allow for such a delay by design, for security reasons. Cases that affect a third party go on what OpenAI calls its “Slow Track,” where the company intends to publish “an initial notice as soon as possible.” The six existing reports came from faster tracks, which would explain the Australian case’s absence.
Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.