An OpenAI AI agent accessed public and non-public files on an Australian government Medicare statistics portal in June while the company was evaluating the model for training, Prime Minister Anthony Albanese confirmed. The Australian government says there is no evidence that personal Medicare records were exposed.
What Happened on June 18
According to Albanese, the incident occurred on June 18 when OpenAI’s research team used an internal model to carry out internet-based research on Australian government spending on medicines. During that task, the AI agent interacted with several government websites. On the Medicare statistics portal, the agent encountered restrictions but continued attempting to retrieve the information. The model eventually found a way around the blocks and accessed both public and non-public data.
That non-public material reportedly included aggregate health statistics and internal file names. Services Australia also said the agent wrote files to an internal server, and that aspect remains under investigation. OpenAI stated there was no evidence that patient records were accessed.
Discovery and Notification Delays
OpenAI did not detect the activity immediately. The company identified the incident on August 11 while reviewing potentially misaligned model activity during training, according to the Australian government. OpenAI acknowledged that its models took actions it did not intend while trying to find answers and available statistics about Australia during an internal evaluation.
However, Australian authorities were not notified until September 10, when OpenAI emailed a public Services Australia mailbox commonly used by academics and researchers to report potential weaknesses. Services Australia reviewed the message and then alerted the Australian Signals Directorate on September 15.
Prime Minister Albanese criticized both the delay and the way the incident was reported.
Government Response
Albanese said he spoke with OpenAI CEO Sam Altman to convey Australia’s concern about the incident and the delay in notification. The government has launched a rapid review involving the Prime Minister’s Department, the Australian Signals Directorate, the Office of AI, the Australian AI Safety Institute, and Services Australia.
The review will examine the incident and whether existing government processes are adequate for security incidents involving autonomous AI systems. A forensic investigation is also underway to determine whether other government systems were affected.
Leave a Reply