Cybersecurity experts and tech investors have accused the Albanese government of blowing the Medicare statistics breach out of proportion, arguing that the website’s code was set up to send data to anyone with the skills to request it.
asserted
code → accuse → it
Archived versions of the website show that its code directed savvy users to a digital address where they could download the statistical information it stored despite that data not being publicly available to people via its front end.
uncertain
data → show → end
Seek co-founder Paul Bassat, one of the country’s most prominent technology investors, echoed questions from prominent industry colleagues about Prime Minister Anthony Albanese’s claim last week that “an AI agent has infiltrated an Australian government website”.
“
uncertain
agent → echo → website
The government clearly wanted to get onto the front foot to seize the initiative in relation to how AI is regulated,” he said, “but as the facts have emerged over the last few days, it looks like there has been a bit of overreach – there’s no question about that.”
asserted
it → want → that
Billionaire Atlassian co-founder Scott Farquhar, who chairs the Australian Tech Council, circulated an article arguing that the site had made the data accessible, while Canva investor Niki Scevak, reposted a meme declaring that OpenAI “accessed unindexed but publicly available files”.
asserted
OpenAI → chair → files
Their views dovetailed with those of senior members of the federal opposition who claimed on Sunday that Albanese had overstated the severity of the issue.
asserted
Albanese → dovetail → issue
Opposition defence spokesman James Paterson said Albanese’s motivations were “pretty transparent” in timing the announcement on the same day as OpenAI chief executive Sam Altman’s speech to the United Nations.
asserted
motivations → say → Nations
“Firstly, Medicare wasn’t hacked,” Paterson said on News24, formerly Sky News.
asserted
Paterson → hack → News24
“It was a Services Australia statistics portal, and the data that was obtained is prepared solely for the purpose of it being publicly released.
asserted
it → obtain → purpose
“And secondly, I’m not even sure you can really call it a ‘hack’.
asserted
you → ’m → it
If it is a hack, it’s the least sophisticated from a technical point of view.
asserted
it → ’ → view
But that doesn’t mean that we shouldn’t be treating this as basically a free warning, because the next time this happens it could be much more serious.”
uncertain
it → mean → warning
Bassat agreed, noting that OpenAI could have explained the breach publicly and avoided any politicking.
uncertain
OpenAI → agree → politicking
“It’s quite possible that there are no heroes in this story,” he said.
asserted
he → ’ → story
OpenAI said in a statement at the weekend that it would pause training its models until “we are confident that we have additional safeguards” in place after it disclosed the Australian incident was only one of dozens around the world in which its bots had gone beyond their intended tasks.
asserted
bots → say → tasks
It is the second time in three months that OpenAI has halted development of its models.
asserted
OpenAI → halt → models
The first was in July after disclosure of a cyberattack targeting AI start-up Hugging Face, a notorious incident that raised fears the industry was losing control.
asserted
industry → target → control
Deputy Prime Minister Richard Marles rejected the claim that Albanese had exaggerated the threat.
uncertain
Albanese → reject → threat
“The seriousness doesn’t lie in the information that was obtained.
asserted
that → lie → information
It was the fact that we’ve got an unintended action of an AI agent gaining unauthorised access into an Australian government website.
asserted
we → get → website
So both of those things are true,” Marles said on News24’s Sunday Agenda.
asserted
Marles → say → Agenda
Vaughan Shanks, chief executive of Melbourne cybersecurity company Cydarm, said the OpenAI tool’s decision to download files that were not listed on the website’s visual front end was “mildly naughty”.
asserted
that → say → end
“That’s called obscurity, not security,” he said.
asserted
he → call → ?
“If they wanted to make it secure, they wouldn’t put it in a public directory.”
asserted
they → want → directory
Archived versions of the Medicare Statistics Reporting Service portal verified by technology publication Recorded Future News show that until 2025, accessing the address to download data did not require a login.
asserted
accessing → verify → login
From March that year, the portal did demand a “guest” login, which granted access without any password or username.
asserted
which → demand → password
It is not clear if the site was intentionally set up in that manner to let researchers access public data or if it was an oversight that allowed the bot to gain access.
asserted
bot → set → access
The government has assembled a taskforce including the Cybersecurity Co-ordinator, Office of AI, Australian Signals Directorate and Services Australia to investigate the breach.
asserted
government → assemble → breach
A Greens-led Senate inquiry has also asked Sam Altman to give evidence this week.
asserted
inquiry → lead → evidence
Shanks said the bot’s behaviour was akin to a passerby looking over a fence.
asserted
behaviour → say → fence
“Nothing was stolen,” he said.
asserted
he → steal → ?
But Toby Walsh, a University of NSW professor of artificial intelligence, said the point was not that the incident was harmful, but that it showed big tech bosses’ warnings that they could lose control of AI systems had come true.
uncertain
they → say → systems
“Their AI has run rogue for weeks at a time,” Walsh said.
asserted
Walsh → run → time
“They really have no idea of what it is doing.”
asserted
it → have → what
He said the world was lucky that the tools had not yet proved capable of causing real harm.
asserted
tools → say → harm
“We really should be holding companies (and officers of these companies) accountable,” Walsh said.
asserted
Walsh → hold → companies
“Then they might pay a bit more attention to preventing these needless hacks.”
uncertain
they → pay → hacks
A Services Australia spokesman said it was investigating the incident and its response to OpenAI’s email.
asserted
it → say → email
“As the investigation remains ongoing, we cannot provide further information at this stage,” the spokesman said.
asserted
spokesman → remain → stage
The Business Briefing newsletter delivers major stories, exclusive coverage and expert opinion.
asserted
newsletter → deliver → stories
The Aporia
