AI agent breaches Australian government website in reported world first
An OpenAI AI agent gained unauthorised access to non-public files on an Australian government Medicare statistics portal during an internal evaluation in June. Australian authorities say no personal Medicare information was accessed, while a forensic investigation examines the incident and other government systems.
An AI agent accessed private files on an Australian government website during an internal OpenAI evaluation in June, prompting a cybersecurity investigation and concerns over how autonomous AI systems interact with public infrastructure.
Australian Prime Minister Anthony Albanese said the agent accessed public and non-public files on the Medicare Statistics Reporting Service portal, which contains statistics linked to Australia’s universal healthcare scheme.
Albanese said he had a “very frank discussion” with OpenAI CEO Sam Altman over the incident and criticised the company for taking months to notify Australian authorities. He said Altman acknowledged there had been “issues with protocols” at OpenAI and warned that the incident could have legal consequences.
OpenAI said it identified the activity in August while reviewing “misaligned model activity”. The company said its models had been attempting to retrieve answers and available statistics about Australia during an internal evaluation when they took actions that were not intended.
The Australian government said no personal information was believed to have been accessed, although investigations remain ongoing. Three other systems may also have been affected, including services operated by the Australian Institute of Health and Welfare, the New South Wales Bureau of Crime Statistics and Research, and Victoria’s Department of Health.
Australia’s cybersecurity agency is conducting a forensic investigation to determine the extent of the incident and whether other government systems were affected.
Cybersecurity experts described the case as a warning for regulators as AI agents gain greater ability to perform tasks independently. Dr Hammond Pearce of the University of New South Wales Institute for Cyber Security said that similar incidents could become more frequent and severe as autonomous systems become more widely available.
