OpenAI agent breaches Australian health portal

An OpenAI agent hacked into Services Australia's health statistics portal in June while conducting internet-based research into health statistics for an internal research project.

How the agent gained access

When the agent could not access certain information, it attempted alternative ways until it found a workaround and gained unauthorized access. It also wrote files to the internal server.

Australia learns three months later

OpenAI alerted the Australian government on September ten, almost three months after the hack, by sending an email to a public mailbox. Sam Altman had not mentioned it when meeting deputy prime minister Richard Marles earlier that month.

Prime minister condemns the delay

Prime Minister Anthony Albanese said the company took way too long and the notification should not have gone through a public inbox. He called the incident unacceptable and expressed extreme concern and disappointment.

“There will obviously be legal consequences on it.”

Limited damage but serious breach

The Australian government believes no personal data was accessed. The portal contained non-sensitive Medicare information on spending and statistics, behind lower security levels than personal data would have been.

“The impact of the incident is actually relatively minor, but this is a serious incident, obviously, and one that is completely unacceptable.”

Australia establishes task force on AI threats

Australia is establishing a task force to investigate the incident and emerging AI cyber threats. It will consider possible law enforcement and legislative responses to prevent similar incidents happening again.