Days after a report disclosed that AI models and agents of OpenAI had breached the Australian government’s Medicare portal, the AI company said on Monday that its AI agents had breached the Services Australia portal and accessed data from two more Australian health portals and a crime records database in an unauthorized manner.
In a blogpost published Monday, OpenAI apologized for the actions of its AI models and said that they could have handled their response better. OpenAI has offered no-cost API credits to the Australian government under their $1 billion Daybreak for Frontline Defenders fund and said that their Chief Strategy Officer, Jason Kwon, will fly in from OpenAI’s US headquarters to appear at the Joint Select Committee on Artificial Intelligence in Sydney on Tuesday 6 October.
The response by OpenAI comes days after the Australian Prime Minister Anthony Albanese confirmed the AI breach and expressed his disappointment over how the US based AI company had hidden the breach for months. PM Albanese also said that his government is contemplating if the AI breach could be investigated by the federal police.
According to OpenAI, its AI models had breached the ‘Services Australia’ portal and “ran commands, retrieved internal files, credentials and aggregate statistics, and wrote files.”
“one of the tasks assigned to the model was to research government spending per person on medicines for skin conditions in Victorian communities. The model had difficulty obtaining that information, and it took actions that we had not authorized it to take. In the course of looking for this information at Services Australia’s Medicare Statistics Reporting Service, it discovered a way to gain non-public access to the service. It then used this access to review technical system information and source code related to the service,” read a statement from OpenAI.
Similarly, the AI models had accessed data from New South Wales’ Bureau of Crime Statistics and Research (BOCSAR) API and website metadata requests via the public BOCSAR tool.
OpenAI also confirmed that its AI agents had retrieved data from the Victorian Department of Health website by discovering an exposed access key and also retrieved aggregate statistics from Australian Institute of Health and Welfare by using third-party browsing and download services.
OpenAI announced that they will support Australian governments and industry through credits from their $1 billion Daybreak for Frontline Defenders fund and technical assistance to strengthen cyber defences across critical infrastructure and other sensitive environments and establish a taskforce with independent Australian expertise to develop practical policy recommendations for managing risks from increasingly capable AI agents.
“Australia’s governments, industries, and citizens are and have been invaluable partners to OpenAI. We do not take this for granted, and we intend to make this right. OpenAI’s. Chief Strategy Officer, Jason Kwon will answer questions about what we know, how we responded, what steps we have taken, and how we will do better going forward,” read a blogpost from OpenAI.
