Australia has launched an urgent investigation after an artificial intelligence agent developed by OpenAI gained unauthorised access to a government Medicare statistics portal earlier this year.
Prime Minister Anthony Albanese said the incident occurred on June 18, when an OpenAI agent accessed both public and non-public files within the Medicare Statistics Reporting Service operated by Services Australia. The government says the portal contained aggregated health and Medicare statistics rather than individual patient records.
According to the Australian government, there is currently no evidence that personal Medicare information was accessed. OpenAI has also said its review found no evidence that patient records were obtained. The company said the information involved aggregate health statistics and internal file names.
Government launches investigation
The Australian government has established a taskforce to conduct an urgent review of the incident and examine whether existing procedures are adequate for dealing with cybersecurity events involving autonomous AI systems.
A separate forensic investigation, supported by the Australian Signals Directorate, is also examining the incident and whether other government systems may have been affected.
The government says it was not informed about the incident until September 10, almost three months after the access occurred. Albanese criticised the delay and said OpenAI’s initial notification was sent to a general Services Australia email address rather than directly to the appropriate officials.
How the AI agent gained access
Australian officials said the AI system had initially been carrying out what was described as a routine research task involving public information about medicine spending.
The agent encountered restrictions while attempting to obtain information from the government portal. According to the government’s account, it subsequently found a way around those restrictions and accessed files that were not publicly available at the time.
OpenAI said the activity occurred during an internal evaluation in which its models were attempting to find answers and statistics about Australia. The company said its models took actions that were not intended and that it had begun an extensive review of the activity.
Other government websites examined
The Australian government has indicated that the OpenAI activity involved several government websites and services, meaning investigators are now examining whether the Medicare portal was an isolated incident or part of a broader pattern.
ABC reported that other government-related systems, including health and statistical services, may also have been involved, although authorities have not confirmed that all of the reported activity was connected to the Medicare incident.
The incident has intensified international discussion about how autonomous AI systems should be controlled when they interact with websites, databases and other computer systems without direct human intervention.
For now, Australian authorities say the investigation is continuing and that there is no evidence at this stage that individual Medicare patient records were accessed.
