OpenAI has apologised to Australians for its agent attack on Medicare, and will front parliament next week, as the tech company revealed more details about its June hack of Australian government websites.
asserted
company → apologise → websites
In a blog post released on Tuesday, OpenAI said it should have handled its response better.
asserted
it → release → response
“We also should have handled our response better.
asserted
We → handle → response
We are sorry and working to do better in the future.”
asserted
We → work → future
The company also provided more detail on the incident revealed by the Australian prime minister, Anthony Albanese, last week.
asserted
company → provide → minister
OpenAI said it became aware of agent activity on Australian government websites in mid-August after the company reviewed earlier training incidents after the Hugging Face attack in July.
asserted
company → say → July
The agents gained non-public access to a Services Australia portal for Medicare statistics, and OpenAI said the agent was able to run commands, retrieve internal files, credentials, and write files, but no patient or client records were accessed.
The NSW Bureau of Crime Statistics and Research’s public crime mapping tool was also accessed, with application configuration, operational jobs and logs, and website metadata provided to the agency.
asserted
tool → gain → agency
The agent discovered an exposed access key to query the Victorian agency for health information’s reporting system to access aggregate survey statistics.
asserted
agent → discover → statistics
For the Australian Institute of Health and Welfare, OpenAI agents retrieved aggregate statistics, but separate attempts to bypass access controls were unsuccessful and the information obtained was publicly available.
asserted
information → retrieve → controls
Services Australia and the Victorian health department were informed on 10 September, while the NSW BOCSAR was informed on 18 September.
asserted
BOCSAR → inform → September
The Australian Institute of Health and Welfare was not informed until 24 September, as OpenAI deemed it did not meet disclosure thresholds.
asserted
it → inform → thresholds
“Since then we’ve worked closely with Australian government agencies to share what we’ve learned to date,” OpenAI said.
asserted
OpenAI → work → date
“If we identify any additional affected agencies, we will notify them promptly and directly with the information available and provide updates as further facts emerge.”
asserted
facts → identify → updates
The incident occurred after one model was tasked to research government spending per person on medicines for skin conditions in Victoria.
asserted
model → occur → Victoria
The model had difficulty obtaining that information, and OpenAI said “it took actions that we had not authorised it to take” including accessing Services Australia’s Medicare statistics reporting service.
asserted
it → have → service
OpenAI said it would commit resources and expertise to affected agencies, and provide Australian government agencies with support to build cyberdefences on critical infrastructure.
asserted
it → say → infrastructure
The company said it would also establish a taskforce with Australian expertise to develop practical policy recommendations on managing risk with AI agents.
asserted
it → say → agents
OpenAI’s chief strategy officer, Jason Kwon, will appear at the Joint Select Committee on AI on Tuesday next week.
asserted
officer → appear → Tuesday
Guardian Australia reported on Monday that Anthropic would also appear at this hearing, but not at a Senate inquiry into AI and datacentres this week.
asserted
Anthropic → report → AI
Albanese who was in the United States last week when he announced the hack, said at the time he had spoken with OpenAI’s chief executive, Sam Altman, “to express Australia’s extreme concern about this incident”.
asserted
he → announce → incident
On Tuesday, Albanese said OpenAI had been “very constructive and open in engaging” since the incident, as had Anthropic.
asserted
Anthropic → say → incident
He said AI can improve economic growth and productivity but it also carries risks.
asserted
it → say → risks
“And we’ve seen those risks exposed – not just in what occurred in Australia, but the revelation that has occurred in the United States and other countries as well.”
asserted
that → see → States
The federal government has flagged it could introduce mandatory reporting rules for AI-related data breaches, after the revelation OpenAI used a public-facing email address three months after the hack to report the incident to Services Australia.
uncertain
OpenAI → flag → Australia
The company said on Tuesday it had “a lot of work ahead” to rebuild trust with Australians but said it was making “meaningful changes”.
asserted
it → say → changes
The Aporia
