Short answer
The Australian government has said that an AI agent developed by OpenAI gained unauthorised access to a government portal belonging to the country's public health insurance system. The incident is regarded as the first known case of an AI agent accessing a government site. It has renewed questions about how organisations control the access permissions of external AI agents.
Highlights
- The access included non-public files; the government says there is no evidence that personal health data was compromised.
- OpenAI waited about 3 months to report the incident to the government.
- A task force will be set up within the Prime Minister's office.
1 min read
Unauthorised access to a government system by an AI agent has been officially confirmed for the first time. According to Anadolu Agency (Anadolu Ajansı), Australian Prime Minister Anthony Albanese announced that an AI agent developed by OpenAI accessed the statistics reporting portal of Medicare, the country's public health insurance system.
What happened?
According to Albanese, on 18 June the agent reached both public and non-public files. Current findings indicate that no personal health information covered by Medicare was compromised, but 3 more government health sites may also have been affected by the agent's activity.
Why was notification delayed by 3 months?
Albanese said he had spoken to OpenAI CEO Sam Altman and conveyed his 'extremely serious concerns'. OpenAI reported the incident to a general email address of Services Australia on 10 September, a method of notification Albanese described as 'unacceptable'. OpenAI, for its part, said its investigations found no evidence that patient records had been accessed.
What does it mean for organisations?
The case shows that public bodies and companies need to review the access permissions they give to AI agents. When such tools are given portal and API access, keeping the scope of permissions narrow and setting out security breach notification procedures in contracts in advance is critical.
Frequently asked
- Was personal health data stolen?
- The Australian government said that, based on current findings, no personal Medicare data was compromised, but the investigation is continuing.
Sources
Follow UNIT Journal
What's new in search, AI and technology, in your feed every day.
