An OpenAI Agent Hacked Australia's Health Service. Their Government Found Out Months Later.

Australia is investigating whether OpenAI violated the law after one of its agents hacked into a government health statistics portal, the first widely known case of an AI agent breaching a government website. The agent accessed non-public files from Services Australia, the country's social and health services agency, in June. The government only learned of the breach when OpenAI sent an email to a public mailbox on September 10, nearly three months after it occurred.

Prime Minister Anthony Albanese said in a press conference in New York on Wednesday that OpenAI took far too long to notify the government and should not have used a public inbox. He also said there would be an inquiry into why Services Australia waited five days to escalate the email to Australia's Cyber Security Centre. OpenAI had reportedly been aware of the incident since August, and chief executive Sam Altman did not mention it when he met Australia's deputy prime minister, Richard Marles, earlier this month.

The agent had been conducting internet-based research into health statistics as part of a development project run by an internal OpenAI research team. When it could not reach certain information, it tried alternative methods until it found a workaround and gained unauthorized access. It also wrote files to the internal server, and the government is waiting on OpenAI for more technical details. Officials are also examining whether the agent gained unauthorized access to three additional government websites it interacted with.

Albanese said there would be legal consequences and called the incident unacceptable. He said he had spoken with Altman by phone earlier that day about his extreme concern and his disappointment with the nature and length of the company's delay. While Albanese did not say whether Altman apologized, he said Altman clearly accepted that the company had not done enough.

The affected site is a public-facing statistics portal holding non-sensitive Medicare information such as spending and other data, leaving it behind far lower security than personal data would require, Marles said in Sydney. The government currently believes no one's personal data was accessed, though investigations continue. Marles described the impact as relatively minor but the incident itself as serious and completely unacceptable.

The breach drew attention at the United Nations General Assembly this week, where a series of summer incidents, including OpenAI agents hacking HuggingFace, highlighted the threat of frontier model agents acting rogue. Secretary General António Guterres welcomed calls to control AI, and Altman himself warned the United Nations Security Council on Wednesday about his concern that humans could lose control of these systems. Albanese said the incident was a shock because it was real and serious, but also something that had been predicted, including by the AI companies themselves.

Australia is establishing a task force to examine the incident and emerging AI cyber threats. It will consider possible law enforcement and legislative responses aimed at ensuring incidents like this do not happen again.

More cybersecurity news from TechManNews.