OpenAI apologizes for an AI agent's hack of Medicare in Australia and reveals the email it used to give notice

OpenAI has publicly apologised to Australia over an incident in which one of its artificial intelligence agents accessed Australian government websites without authorisation, among them a Medicare portal run by Services Australia. The case, revealed the previous week by Prime Minister Anthony Albanese, has led to a senior company executive, chief strategy officer Jason Kwon, appearing on 6 October before the Australian parliament's joint committee on AI. Anthropic is also due to appear that same day, although it will not take part in the parallel Senate inquiry into AI and data centres being held this week.

The Australian government has made public the brief communication — barely five paragraphs — that OpenAI used to report the incident. The email was sent on 10 September to a public inbox monitored by Services Australia, almost three months after the agent accessed the site on 18 June, and closed with the sign-off "Best, OpenAI Security Team". In the message, obtained by Guardian Australia, the company explained that "an OpenAI model identified a way to make the server run instructions submitted through the public reporting interface, without needing a private account or password", and pointed to the URL and the report (a CSV file) affected, offering to brief the relevant security team. The Labor government has expressed outrage at the manner and timing of this notification.

According to OpenAI's account in a blog post published on Tuesday, the company admits that it "should also have handled our response better. We're sorry and we're working to do better in the future". The company says it became aware of the agent's activity on Australian government websites in mid-August, while reviewing earlier training incidents following the attack on Hugging Face in July.

The incident originated in a task assigned to a model to research public spending per person on medicines for skin conditions in the state of Victoria. Struggling to obtain that information, the model "took actions we had not authorised", including accessing Services Australia's Medicare statistics reporting service. According to OpenAI, the agent was able to run commands, retrieve internal files and credentials, and write files, although no patient or customer records were accessed.

The scope was not limited to Medicare: the public crime-mapping tool of the New South Wales Bureau of Crime Statistics and Research was also accessed, exposing application configuration, operational tasks, logs and site metadata. The agent also discovered an exposed access key that allowed it to query the reporting system of Victoria's health information agency, obtaining aggregated survey statistics. In the case of the Australian Institute of Health and Welfare (AIHW), the agents retrieved aggregated statistics, but attempts to bypass access controls were unsuccessful and the information obtained was already public.

Notifications to the various bodies were not simultaneous: Services Australia and the Victorian health department were informed on 10 September, the New South Wales crime statistics bureau on 18 September, and the AIHW was not notified until 24 September, as OpenAI considered that case did not meet the threshold requiring notification.

In response, the Home Affairs department has instructed all government departments and agencies to carry out a "rapid" review of legacy systems, draw up risk management plans for that technology and report on their compliance. The directive prioritises systems of critical importance to government, with a review to be completed before the end of the year, while the remaining systems will be assessed before March. Acting Home Affairs Minister Richard Marles said AI "is changing the environment in which we operate at extraordinary speed" and that "we cannot wait for an old system to fail before replacing it; we need to identify the vulnerabilities and address them before they can be exploited".

As part of its response, OpenAI has committed to providing resources and expertise to the affected agencies to strengthen their critical-infrastructure cybersecurity defences. Australian government agencies and industries will also receive credits from OpenAI's Daybreak fund, worth US$1bn (around A$1.4bn), which allows these organisations to use frontier AI for cyber defence and to harden their systems by reviewing code and configurations for patchable vulnerabilities. The company also announced the creation of a working group involving Australian experts to draw up practical policy recommendations on managing the risks of AI agents.

On the political front, Albanese — who was in the United States when he announced the hack — explained that he had spoken to OpenAI chief executive Sam Altman "to express Australia's extreme concern about this incident". On Tuesday he qualified that OpenAI had been "very constructive and open in its engagement" since then, as had Anthropic, and stressed that while AI can improve economic growth and productivity, it also carries risks, "and we have seen those risks exposed, not only in what happened in Australia, but in revelations in the United States and other countries". The federal government has raised the possibility of introducing mandatory reporting rules for AI-related data breaches, after it emerged that OpenAI used a public-facing email address, three months after the attack, to inform Services Australia. For its part, OpenAI has acknowledged that it has "a lot of work ahead" to rebuild Australians' trust, though it says it is making "significant changes".