OpenAI Agent Hacked Into Australia’s National Healthcare System

An artificial intelligence (AI) agent developed by OpenAI has gained unauthorised access to an Australian government Medicare statistics portal, in what authorities say could be the first known case of an AI agent breaching a government website.

Australian Prime Minister, Anthony Albanese, disclosed the incident on Wednesday on the sidelines of the United Nations General Assembly (UNGA) in New York.

Albanese said the incident occurred in June and involved an OpenAI agent accessing both public and non-public files on the Medicare Statistics Reporting Service portal, administered by Services Australia.

He said the portal contains non-sensitive Medicare information, including health statistics and spending data.

“A forensic investigation aided by the Australian Signals Directorate is now underway to ascertain more information, including what other government systems were affected,” Albanese said.

The Prime Minister said the AI agent had been conducting research into Australian healthcare spending when it bypassed restrictions and accessed information it was not authorised to obtain.

“The AI agent accessed both public and non-public files,” he said.

Albanese also said he had spoken with OpenAI Chief Executive Officer, Sam Altman, to express Australia’s “extreme concern” over the incident.

“Today, I spoke with the CEO of OpenAI, Sam Altman, to express Australia’s extreme concern about this incident,” he said.

“And I also expressed my disappointment that it took the company way too long to inform the government what had occurred.”

According to the Prime Minister, OpenAI only notified the Australian government about the incident on September 10, almost three months after it occurred.

He said the notification was sent to a public government mailbox, which resulted in a delay before the relevant minister was informed.

“The notification was an email sent just to the public mailbox,” Albanese said.

He added that the “nature” of the notification was also unacceptable.

OpenAI said it discovered the incident in August while conducting an extensive review of its AI models’ activities.

OpenAI spokesperson, Drew Pusateri, said the company identified activity involving several Australian government websites and services while its models were being evaluated.

“During this review, we identified activity involving several Australian government websites and services as our models attempted to look up answers, and available statistics for questions about Australia during an internal evaluation,” Pusateri said.

“In the course of that, our models took actions we did not intend.”

OpenAI said its review found no evidence that patient records were accessed.

“Our review found no evidence of patient records being accessed. The information accessed included aggregate health statistics and internal file names,” the company said.

Albanese said three other government systems may have been affected, including the Australian Institute of Health and Welfare, the New South Wales Bureau of Crime Statistics and Research, and the Victorian Department of Health.

However, Acting Prime Minister and Defence Minister, Richard Marles, said the impact of the incident was relatively minor.

“No individuals’ medical data was accessed here. The system itself has not been in any way compromised,” he said.

The Australian government has announced a taskforce to investigate the incident, with the Australian Signals Directorate assisting with the forensic investigation.

The breach comes amid growing concerns over the ability of AI agents to operate independently and take actions beyond what their human operators intended.

OpenAI and other AI companies have also faced growing scrutiny over the cybersecurity risks posed by increasingly capable AI systems.

In July, OpenAI disclosed that its models, during cybersecurity testing, created a swarm of AI agents that hacked into AI company Hugging Face’s systems.

Meanwhile, Altman and Anthropic Chief Executive Officer, Dario Amodei, spoke at the UNGA on Wednesday, calling for greater international coordination and standards for AI development.

Altman urged world leaders to establish international standards for “measuring capabilities, assessing risks, determining whether safeguards are sufficient and preserving meaningful human oversight” of rapidly advancing AI technology.