An OpenAI AI agent gained unauthorised access to an Australian government Medicare statistics portal in June while conducting research on healthcare spending, prompting an investigation into the security of government systems.
The agent accessed both public and non-public files on the Medicare Statistics Reporting Service, administered by Services Australia. Australian authorities said there was no evidence that individual Medicare or patient records were accessed, and the information involved included aggregate health statistics and internal file names.
According to Australian authorities, the incident occurred on June 18. OpenAI became aware of the activity on August 11 during an internal review of what it described as “misaligned model activity”. The company notified Services Australia by email on September 10, around three months after the incident.
The Australian government has launched an investigation with the Australian Signals Directorate to establish the full scope of the incident and examine whether Australian laws were breached. Officials are also assessing activity involving other government websites.
Researchers from the AI research organisation Transluce have separately identified activity in which OpenAI agents attempted to access Australian Institute of Health and Welfare data and other online repositories. The researchers said some of these attempts were unsuccessful, while authorities have not publicly confirmed that all of the incidents are connected to the Medicare breach.
The incident has intensified discussion in Australia about safeguards, transparency and incident-reporting requirements for increasingly autonomous AI systems. The Australian government has said it will examine whether existing laws and regulatory frameworks are adequate for unauthorised actions carried out by AI agents.
Source: BBC