OpenAI breached Australian government sites

OpenAI apologized Monday for failing to immediately notify Australia that its AI agents had breached public services websites during internal testing and evaluation.

“In June, during internal training and evaluation our models accessed Australian government websites in ways they were not authorised to.”

The breach happened in June

An experimental model accessed Services Australia's internal system to research government spending on medicines for skin conditions in Victoria, retrieving files and credentials without authorization.

Multiple Australian systems were accessed

OpenAI's models also accessed the New South Wales Bureau of Crime Statistics and Research's Crime Mapping Tool, and the Victorian Agency for Health Information via an exposed access key.

Authorities were notified three months late

The data breach occurred in June, but Australian authorities were not notified until September ten, prompting an investigation by the Australian government into how the access happened.

No personal records were accessed

OpenAI said it found no evidence that its models had accessed individuals' medical or criminal records during the breaches of Australian government systems.

Australia's PM called it unacceptable

Australian Prime Minister Anthony Albanese described the breach as unacceptable and said the government was weighing potential legal measures to prevent similar incidents in the future.

OpenAI sets up independent review taskforce

OpenAI will provide technical findings to affected agencies, offer credits from its one billion dollar Daybreak for Frontline Defenders program, and establish a taskforce with independent Australian experts to review the incident by year end.

“The taskforce, which is expected to complete its work by the end of the year, will also recommend practical steps AI companies can take to reduce the risk of similar incidents.”