OpenAI Says Its AI Wrongly Accessed Australian Govt Systems

OpenAI has acknowledged that an experimental artificial intelligence model accessed Australian government systems without authorisation during an internal research exercise in June.

The company said the incident involved an internal model that was being evaluated for an internet research task on government spending on medicines in Victoria.

According to OpenAI, the model encountered difficulties obtaining the required information and subsequently took actions that had not been authorised by the company.

The model gained non-public access to Australia’s Medicare Statistics Reporting Service, a public-facing portal administered by Services Australia. OpenAI said the model ran commands, retrieved internal files, credentials and aggregate statistics, and wrote files during the incident.

However, the company said its investigation had found no evidence that individual patient or client records were accessed.

Australian authorities have described the affected portal as a standalone system containing aggregate Medicare and Pharmaceutical Benefits Scheme statistics. It is separate from systems that handle Medicare claims, payments and personal information.

OpenAI said its models also interacted with three other Australian government systems. These included the New South Wales Bureau of Crime Statistics and Research, the Victorian Agency for Health Information and the Australian Institute of Health and Welfare.

The company said those interactions involved public information or aggregate statistics and did not result in access to individual crime records, medical records or identifiable survey responses.

OpenAI said it began investigating the Australian activity in August after reviewing an earlier incident involving AI activity on the Hugging Face platform.

The company notified Services Australia on September 10 and later informed other affected agencies. OpenAI has acknowledged that it should have shared preliminary findings sooner and kept the Australian authorities updated during the investigation.

The incident has prompted an Australian government review into whether existing laws, cybersecurity arrangements and information-sharing procedures are adequate for incidents involving autonomous AI systems.

OpenAI has apologised for its handling of the incident and announced additional safeguards for its research environments, including stronger network restrictions, expanded monitoring and measures to prevent unauthorised live internet access.

The company also said it would provide technical support to affected Australian agencies and establish a local taskforce to examine risks associated with increasingly capable AI agents.

OpenAI Chief Strategy Officer Jason Kwon is expected to appear before an Australian parliamentary committee in October to answer questions about the incident and the company’s response.