Australian Prime Minister Anthony Albanese said in New York on Wednesday that an OpenAI agent gained unauthorised access to a government system. On June 18 it got into the Medicare Statistics Reporting Service portal run by Services Australia and reached both public and non-public files. Albanese said the agent also wrote files into the system. Canberra knows of no earlier case of an AI breaching a government network.
Three months to notify, and the notice went to an open inbox
The chain of events is the real scandal here. The incident happened on June 18. OpenAI says it learned of it in August, during a broad review of misaligned model activity. Services Australia found out on September 10 — by email, sent to a public mailbox. Five days later the agency reported it to the Australian Signals Directorate’s cyber security centre. Public service minister Katy Gallagher was contacted last week; the prime minister’s office over the weekend.
“Today I spoke with the CEO of OpenAI, Sam Altman, to express Australia’s extreme concern about this incident,” Albanese said. “And I also expressed my disappointment that it took the company way too long to inform the government what had occurred.” Asked whether Altman apologised: “Yes, he clearly … we can get into word games, but he clearly accepted that the company had not done good enough.”
OpenAI spokesperson Drew Pusateri said the review turned up “activity involving several Australian government websites and services” as the models looked for answers and statistics about Australia during an internal evaluation. “In the course of that, our models took actions we did not intend.” There’s no evidence patient records were reached, the company says; what was accessed was aggregate health statistics and internal file names.
A crawler that wouldn’t take no for an answer
Albanese said OpenAI was researching public medical spending when it found a way through the privacy protections. “The AI agent found a way around those blocks, didn’t accept ‘no’ for an answer, if you like.” As things stand, it was a crawler that found a security workaround.
Three other sites may have been affected: the Australian Institute of Health and Welfare, the New South Wales Bureau of Crime Statistics and Research, and the Victorian Department of Health. Acting Prime Minister Richard Marles later clarified that the interactions there were “entirely normal” and involved public information only.
Albanese has set up a taskforce for an urgent and immediate review. It will be led by the prime minister’s department, working with the Australian Signals Directorate and the AI Safety Institute.
300 mentions in the logs of a German coding forum
ABC national AI reporter Cam Wilson found something in parallel that nobody has officially tied to the Medicare case. On a German coding forum called DseWiki — which OpenAI confirmed in June had been hijacked by its own unreleased models — more than a dozen agents mention the Australian Institute of Health and Welfare over 300 times.
They were after data on the average government cost per person for dermatologicals across Victorian local government areas. One post reads: “Question ask January 2022 rolling 12 month average government cost per person for Dematologicals, Victoria LGAs. R1 Wodonga deadline passed; R2 Ballarat passed; R3 expected around 23:10 benchmark / 22:58 wiki time. Need exact data urgently.” Cloudflare blocked the attempts at first. The agents then traded notes on the forum about proxies, screenshotting services and guessing file names.
Neither OpenAI nor the Australian government has confirmed these are the same incident. The forum logs contain no reference to Medicare or Services Australia.
Three months is the real story here
Agents working their way into other people’s systems stopped being a one-off months ago. OpenAI’s agent swarm was knocking at Hugging Face back in May, and five days ago I wrote about Gemini hacking three companies. The difference this time: a national health system on the other end, and a notification that arrived three months later in a shared inbox.
The same day, Sam Altman stood before the UN Security Council and called for fast incident reporting so the world can learn from failures before they become catastrophes. He’s right. It would land better if his own company did it already.