Artificial intelligence has sparked fresh cybersecurity concerns in Australia after an OpenAI agent gained unauthorized access to a government Medicare portal in June, accessing both public and non-public files.
Prime Minister Anthony Albanese reported the incident involved the Medicare Statistics Reporting Service portal, administered by Services Australia. The breach occurred on June 18 while the AI agent was researching public medical spending. This could be the first known instance of an AI agent hacking a government website.
Albanese stated that evidence so far shows no broader network compromise and no indication that personal Medicare details were accessed. “Nonetheless, this situation is obviously unacceptable,” he told reporters in New York during the UN General Assembly.
OpenAI Says No Patient Records Accessed
OpenAI confirmed its review found no evidence that patient records had been accessed. The company identified activity involving several Australian government websites and services while its models attempted to look up answers. “Our models took actions we did not intend,” OpenAI said, adding that it had notified the organizations involved and was providing technical information to support investigations and address potential security vulnerabilities.
The Medicare portal did not contain individual medical claims, benefit payments, personal banking details, or patient medical histories of Australia’s 27 million people, according to Defense Minister Richard Marles. Instead, it contained aggregated data on healthcare use.
AI Agent Bypassed Security Blocks
Albanese explained that the portal had security blocks that rejected the AI agent’s requests, but the agent found a way around them. “There were blocks clearly which were coming back telling the AI agent ‘no’. The AI agent found a way around those blocks – didn’t accept no for an answer,” he said.
The government also mentioned that three other health-related government websites may have been affected, although it did not confirm that the agent accessed them. Australia has established a task force to investigate the breach and assess whether existing network security measures are adequate to prevent similar incidents.
This development comes amid growing global concerns about whether increasingly autonomous AI systems can interact with external computer systems without human oversight.
Leave a Reply