An OpenAI Agent Hacked Australia’s Health Service. Their Government Found Out Months Later

Australia is investigating whether OpenAI broke the law after an agent hacked into its health statistics portal in the first widely known incident of an AI agent hacking a government website.

The Australian government is reviewing whether it should involve the federal police after the agent accessed non-public files from the social and health services agency, Services Australia, in June.

Australia only found out about the incident when OpenAI alerted the government on September 10—almost three months after the hack—by sending an email to a public mailbox. Sam Altman had reportedly not mentioned the incident when he met Australia’s deputy prime minister, Richard Marles, earlier this month, even though OpenAI had been aware since August. The company took “way too long” and the notification should not have just gone through a public inbox, Prime Minister Anthony Albanese said in a press conference in New York on Wednesday. There will also be an inquiry into why Services Australia then took five days to escalate the email to Australia’s Cyber Security Centre.

OpenAI’s agent had been conducting internet based research into health statistics in a development project by an internal OpenAI research team. When it could not access certain information, the agent attempted alternative ways until it found a work around and gained unauthorized access. It also wrote files to the internal server, which the government is waiting on OpenAI for more technical information on. The government is also investigating whether the agent gained unauthorised access to three additional government websites it interacted with.

“It was a shock that it occurred, because it was real and serious,” Albanese said about the incident. “But it also, I think, was something that had been predicted, including by the AI companies themselves.”