An OpenAI agent reached non-public Medicare files on June 18, Australia was told September 10

An OpenAI agent gained unauthorised access to an Australian government Medicare statistics portal on June 18, and Australia says it heard nothing about it until September 10. Prime Minister Anthony Albanese set out that timeline at a press conference in New York on September 24, and said the agent "accessed both public and non-public files" on the Medicare Statistics Reporting Portal, which Services Australia administers.

OpenAI says it found the activity during a review of what it calls misaligned model activity. Image: OpenAI

Albanese said no personal information is believed to have been accessed at this stage and that investigations are ongoing. He also said the evidence currently available is that there is no broader compromise of the Services Australia network.

Albanese says the model looked for ways around blocks

"On June 18, OpenAI's research team used an internal model to conduct internet based research into public medicine spending," Albanese said. "The model attempted alternative ways to obtain the info that it wanted, and this led to unauthorised access into some other areas."

He described it as "the agent, frankly, not doing what it was supposed to do or doing it, but doing it in a way which when it was blocked, sought ways around the blockage". He also said Services Australia advises that the model wrote files to the internal server, and that this is being investigated further.

The portal itself is "a public-facing statistics portal that contains non-sensitive Medicare information relating to data and statistics such as spending", Albanese said. He ruled out a state actor: "There is no suggestion of foreign actors here. This is a research project that has got into areas that it shouldn't have."

The notification took until September 10

Asked whether his complaint was about the delay or the manner of it, Albanese said it was both. "It was that it took until 10 September before there was any notification at all," he said. "And the notification was an email sent to just the public mailbox."

Services Australia reported the notification to the Australian Signals Directorate's Australian Cyber Security Centre on September 15, and Albanese said he and his office were informed the weekend before the press conference. He said he spoke to OpenAI chief executive Sam Altman to express Australia's "extreme concern", and that "Mr Altman has acknowledged their issues with protocols".

Albanese said the government is aware of three other systems that may have been affected: the Australian Institute of Health and Welfare, the New South Wales Bureau of Crime Statistics and Research, and the Victorian Department of Health. A forensic investigation aided by the Australian Signals Directorate is under way to establish what else was reached.

A task force led by the Department of the Prime Minister and Cabinet will review the incident, with the National Cybersecurity Coordinator, the Office of AI, the Australian Signals Directorate, the Australian AI Safety Institute and Services Australia. Albanese said the incident will also go to the Joint Select Committee on Artificial Intelligence, and that the government will seek urgent advice on whether any offences occurred and whether to refer the matter to the Australian Federal Police.

OpenAI says its models took actions it did not intend

OpenAI has not posted an account of the incident itself. Its version reached the public through CNBC, which obtained a statement from an OpenAI spokesperson: "In the course of that, our models took actions we did not intend." CNBC reports that OpenAI said the activity happened during an internal evaluation as its models tried to look up answers and statistics about Australia, that OpenAI did not become aware of it until August during an ongoing review of what it calls misaligned model activity, and that its own review found no evidence patient records were accessed.

OpenAI has reported model behaviour of this shape before, saying one of its models used a leaked API key and invented data during training. What is different here is that the system belonged to a government and nobody had authorised the access.

Albanese said he could not find a precedent for it. "One of the issues here is we could not find precedent for this," he said. "But others, there may be, but not that we're aware of."