OpenAI apologises for Medicare hack and pledges funding for Australian cyber defence

OpenAI has apologised after a model-in-training hacked a Medicare portal in June and has pledged funding to help the Australian government strengthen its cyber defence.

In a statement on Tuesday, the company said it should have handled its response better after the Australian government was not notified of the breach until months later in September.

“In June, during internal training and evaluation our models accessed Australian government websites in ways they were not authorised to,” the company said.

“We are sorry and working to do better in the future.”

An OpenAI model in training tasked to research health and medical statistics approached four Australian government websites – the Medicare Statistics Reporting Service portal, the Victorian Department of Health, the NSW Bureau of Crime and Statistics, and the Australian Institute of Health and Welfare – on June 18.

It gained unauthorised access to the Medicare portal.

“An OpenAI model discovered a way to gain non-public access to the service, and ran commands, retrieved internal files, credentials and aggregate statistics, and wrote files,” the company said.

“However, individual patient or client records were not accessed.”

Read more

Senators demand OpenAI chief appear before inquiry after Medicare breach

OpenAI has since confirmed that the model had also unsuccessfully tried to bypass controls on the Australian Institute of Health and Welfare site and may have accessed unauthorised information from the Victorian Department of Health.

“The extent to which this information should have been accessible is unclear, and depends on Victorian Agency for Health Information’s access policies,” the company said.

OpenAI has pledged to rebuild trust with Australia and take accountability, pausing training and evaluation for its most capable models until it is confident there are safeguards in place.

The company says it will support the Australian government and industry through credits from its $1 billion fund to improve cyber defences and establish a taskforce to develop policy recommendations to manage risks from “increasingly capable” AI agents.

The company’s chief strategy officer, Jason Kwon, will fly into Australia from the US headquarters to face a grilling at a parliamentary committee on AI next week on Tuesday.

Prime Minister Anthony Albanese said he was briefed by OpenAI on Monday.

“OpenAI have been very constructive and open in engaging in that process, and I welcome that,” he told reporters on Tuesday.

OpenAI said it did not become aware of the hack until mid-August.

It notified Services Australia – which runs the Medicare portal – and the Victorian Department of Health on September 10 and the NSW Bureau of Crime Statistics and Research on September 18.

The company said it did not notify the Australian Institute of Health and Welfare because it did not meet the disclosure threshold, but alerted them anyway on September 24.

The Australian government did not become aware of the incident until September 17.

OpenAI said its delay in notifying the sites were to give affected agencies a “detailed account” once its investigation was complete.

“However, we should have shared preliminary findings sooner and kept Australian agencies updated as more facts emerged,” the company conceded.

Read more

Can OpenAI actually be held legally responsible for rogue agent hack?

“Since then we’ve worked closely with Australian government agencies to share what we’ve learned to date.

“If we identify any additional affected agencies, we will notify them promptly and directly with the information available and provide updates as further facts emerge.”

Albanese used the world’s biggest stage, the United Nations General Assembly, to announce that a rogue OpenAI model had hacked the government-run website on Thursday.

The prime minister expressed his “extreme concern” about the incident and disappointment that it took “way too long” to notify the government to OpenAI chief executive Sam Altman on the sidelines of the meeting.

The Australian government is considering legal action against the company.

“This is a challenge that the world is dealing with. Artificial intelligence can improve economic growth, improve our productivity. It can make a big difference for businesses who are using it,” Albanese said.

“But there are risks, and we’ve seen those risks exposed not just in what occurred in Australia, but the revelation that has occurred in the United States and other countries as well.”