Australian Prime Minister Anthony Albanese said on Thursday that an artificial intelligence agent developed by OpenAI “infiltrated” an Australian government statistics portal.
The agent accessed the website without authorization that contained “non-confidential” data from Medicare, Australia’s public health system.
According to Albanese, three other government systems could have been attacked.
The security breach occurred in June, but OpenAI only noticed it in August and did not inform the government until September 10, according to Albanese.
OpenAI says there is no indication that medical records of patients have been accessed.
In a statement, the company said the security breach was detected during a “comprehensive review” on “non-aligned model activity.”
“During this review, we identified activity involving several Australian government websites and services, as our models tried to search for answers and statistics available for questions about Australia during an internal evaluation. In the course of this, our models performed actions that we had not planned,” the company said.
Albanese said he held a “very frank conversation” about the incident with OpenAI chief executive Sam Altman.
“Today I spoke with OpenAI chief executive Sam Altman to express Australia’s extreme concern over this incident, and also expressed my disappointment that the company has taken too long to report to the government about what happened and because the way that notification was made was also unacceptable,” said Albanese, who is in New York to attend the United Nations General Assembly.
Following the Medicare cyberattack, the Australian government announced an urgent review of its artificial intelligence management framework.
According to an official statement, the review will assess whether current legislation and governance systems are “suitable to prevent and respond to AI-related cyberincidents.”
The Department of the Prime Minister and the Cabinet will also examine mechanisms for exchanging information with companies in the sector and with other countries of the Commonwealth.
According to the Australian government, the findings “will serve as a basis” to establish a broader strategy on the regulation and use of artificial intelligence.
According to OpenAI, their model accessed “archives on some Australian government pages and services,” including a page containing non-public data from Medicare, Australia’s health system.
The company said the model was looking for statistics and information about health systems.
Experts consulted by the BBC said it was the first attack by an artificial intelligence model on a government website that is being in the world.
According to the Australian government, the data accessed by the OpenAI agent is not sensitive, but he still protested the incident and how Altman’s company handled the incident.
Although it happened in June, the company said it did not find out until August and that it then it with an email sent to a general directorate for citizen consultations from a government agency.
The Australian Cyber Security Agency was informed days later.
The Australian incident comes at a time of growing concern about the potential dangers of the development of artificial intelligence and when a series of hackings perpetrated by agents have been known.
OpenAI revealed that some of its advanced models escaped the controlled testing environment and attacked several companies, including Hugging Face, also specializing in AI services.
Other U.S. firms, such as Anthropic, similar episodes, raising fears that the development of this new technology could turn against humanity.
And prominent managers from leading companies in the sector, such as Altman himself or Amodei, head of Anthropic, have asked to slow its development and that mechanisms of control and supervision be established.
But U.S. President Donald Trump has been opposed to regulating AI globally.
