What do we know about the OpenAI-Medicare breach? - ABC News & Headlines – Australian Broadcasting Corporation
A swarm of artificial intelligence agents has hacked into protected data on Australia's Medicare portal, one of the first breaches of its kind on a government database.
The prime minister says it took OpenAI three months to say anything about it.
So what was accessed, and why did it take so long for the government to find out?
In June, an Open AI agent was conducting research on medical funding in Australia when it hacked into unauthorised areas of the site. (Reuters: Dado Ruvic)
Speaker 1: Artificial intelligence has hacked into protected data on Australia's Medicare portal, one of the first breaches of its kind on a government database. OpenAI's agent accessed both public and private data from the Australian government's Medicare portal, but it's only been revealed now, three months after the hack happened. So what do we know? The hack actually happened on June 18th and it took OpenAI three months to notify the Australian government about the breach. The government says to its knowledge that no personal medical data was being accessed and Prime Minister Anthony Albanese says he's had a frank conversation with the company's CEO Sam Altman about the unprecedented incident.
Speaker 2: New technology can bring enormous benefits and artificial intelligence can boost our economy, it can boost productivity, it can advance healthcare in ways that were unimaginable a while ago. There are a range of advantages but we need to make sure that humans are in control.
Speaker 1: Worryingly, authorities actually only found out about the breach through an email to the service's Australia Public Inbox two weeks ago. Australia's cyber intelligence agency then started an investigation and ultimately notified the PM over the weekend. Anthony Albanese says not only is the breach itself unacceptable, but so is the way the government was notified. So how serious was the breach and what information's at risk? The breach happened when one of OpenAI's agents was researching public medical spending. As it scoured for data, it found a way around the privacy protections of Services Australia. A taskforce has been set up to find out exactly what was compromised, with OpenAI admitting several other government websites were accessed by its agent. But now there are further questions about whether our most crucial systems are secure enough. Security expert Zoran Tasevski says we need to be prepared for more breaches like this.
Speaker 3: This was supposed to be contained in OpenAI's kind of controlled environment and he actually went out to the World Wide Web and he actually found a website that actually holds some fairly testing projects called OpenFace, broke into it, resolved the problem. So he actually found breaches and he branched out to the world.
Speaker 1: This high-profile breach follows several major leaps in the autonomy of AI agents. You might have heard about the Hugging Face incident. Earlier this year, OpenAI disclosed that two of its own models being tested inside a sandboxed environment with no intended internet access found a way around those restrictions and broke into servers belonging to the AI platform Hugging Face. Zoran Tasevski says this latest breach has similar hallmarks.
Speaker 3: This is actually going to get even more aggressive and it's going to develop even further. I should be worried. I wouldn't be alarmed at this stage, but if some of these breaches are taking place, high attention needs to be applied to this.
Speaker 1: So on one hand, it could be that Australian government cyber security isn't up to scratch. But on the other, it could be that the guardrails within AI companies aren't strong enough. Sam Altman and the heads of several other major AI companies have recently agreed the pace of development needs to slow. And Australia's been one of the chief signatories among dozens of world leaders urging for global AI guardrails so the technology remains under human control.
