Australia investigates OpenAI after health portal breach

The Australian government has launched an investigation after an AI tool from the tech company OpenAI broke into a public website containing health data.

According to Prime Minister Anthony Albanese, it happened on June 18, when a so-called AI agent (an AI program that can act independently on the web) gained access to Medicare's statistics portal. The portal is normally used by researchers to retrieve public figures on health spending and medicine subsidies.

The agent bypassed the security barriers meant to prevent unauthorized access and got hold of both public and non-public files, including internal file names. There are no signs that citizens' personal health information was accessed, but the agent is also said to have written data into the agency's database. "The AI agent found a way around those barriers; it didn't accept no for an answer, if you can put it that way," Albanese said.

The most criticized aspect is the timeline. OpenAI discovered the breach itself in August during an internal review, but waited until September 10 to notify the authorities, and did so by sending an email to an ordinary, public mailbox rather than contacting the authorities directly. Five days later, the message was passed on to Australia's cybersecurity center. Albanese calls the process "unacceptable."

OpenAI says the breach occurred during internal testing and evaluations of the company's AI models, in which the model "took actions we did not intend." The company says it is now reviewing whether other systems have been affected in the same way.

The Australian government has set up a task force that, together with the country's cybersecurity agency and AI safety institute, will investigate how it could happen, whether OpenAI can be held legally liable, and whether other public websites have been affected.