Prime Minister Anthony Albanese has launched a taskforce to investigate how an OpenAI artificial intelligence agent infiltrated a Medicare website in June, but only informed the federal government of the breach three months later.
Speaking to reporters in New York, Albanese said the incident involved an OpenAI agent gaining unauthorised access to the public-facing Medicare Statistics Reporting Service portal, where it accessed public and private files and wrote files to an internal server.
Three other systems may also be affected: the Commonwealth’s Australian Institute of Health and Welfare, the NSW Bureau of Crime Statistics and Research, and the Victorian Department of Health. Victorian Premier Ben Carroll and NSW Premier Chris Minns were informed overnight.
Albanese said the Medicare website was breached on June 18, but the Commonwealth government was only informed after OpenAI emailed a public Services Australia inbox on September 10.
“This situation is obviously unacceptable,” Albanese said. “And today, I spoke with the CEO of OpenAI, Sam Altman, to express Australia’s extreme concern this incident , and I also expressed my disappointment that it took the company way too long to inform the government what had occurred and the nature of the way that that notification occurred as well was unacceptable.”
An AI agent is software that is given a task and works out for itself how to get it done, without a human signing off on each action.
Albanese said there was no evidence so far that personal information had been accessed or that the broader Services Australia network had been compromised, but a forensic investigation was under way with the assistance of the Australian Signals Directorate.
“Evidence currently available is there is no broader compromise to the Services Australia network. Nonetheless, this situation is obviously unacceptable,” Albanese said.
On June 18, an OpenAI research team used an internal model to conduct internet-based research into the public medicine space. The AI agent encountered repeated blocks while seeking information from the Medicare portal but found ways around them, ultimately gaining unauthorised access to other areas.
“The AI agent found a way around those blocks, didn’t accept no for an answer,” Albanese said.
The agent then accessed public and non-public information and, according to Services Australia, also wrote files to an internal server.
In August, Open AI discovered the breach and performed an internal investigation to ascertain what information was accessed.
On September 10, OpenAI informed Services Australia of the breach via an email sent to a public inbox. The email was referred to the Australian Cybersecurity Centre on September 15.
Over the following days, Public Services Minister Katy Gallagher was informed of the breach, with Albanese briefed last weekend.
Taskforce to investigate breach
The government will establish a taskforce to urgently examine the incident and determine whether existing processes are adequate for responding to AI-related cyber incidents.
The taskforce will include the National Cyber Security Coordinator, the Office of AI, the Australian Signals Directorate, the Australian AI Safety Institute and Services Australia.
The review will examine possible law enforcement and legislative responses, as well as whether penalties are applicable to Open AI.
The incident will be referred to parliament’s Joint Select Committee on Artificial Intelligence.
Albanese said the government would seek urgent advice on whether offences were committed and whether the matter should be referred to the Australian Federal Police. The incident will also feed into the government’s planned AI standards legislation.
The tech company has confirmed it is conducting an “extensive review of misaligned model activity during training and evaluation” and that third parties were being notified of potential breaches.
OpenAI said its models had accessed “several Australian government websites and services” during an internal evaluation. The models were trying to look up answers and statistics for questions Australia.
“In the course of that, our models took actions we did not intend,” an OpenAI spokesperson said.
The company said its review found no evidence that patient records had been accessed. It said the information accessed included aggregate health statistics and internal file names.
OpenAI did not say which other government websites and services might have been affected.
The political response
Opposition Leader Angus Taylor on Thursday cast doubt on the timing of the announcement, while his colleagues called for a wide-ranging audit of government security systems.
“The timing is interesting, isn’t it? Yeah. Why is he talking it now when he’s over in the US? I mean, this happened some time back, but we’ve not heard him talking these issues,” Taylor told 4BC radio.
“The government needs to explain when it first became aware of the breach, exactly what information was accessed, what vulnerability was exploited, how they’re closing it.”
Trump’s defence of AI
On Monday, Albanese co-signed a joint statement with 21 other nations at the United Nations General Assembly calling for urgent regulation and guardrails on artificial intelligence.
“AI is changing the world,” Albanese said, pointing to its potential to deliver economic growth, productivity gains and advances in health, science and innovation.
“But AI also poses significant risks, and that’s why we need guardrails to protect our way of life.”
The joint statement was labelled a “globalist scheme” by US President Donald Trump , who is seeking to rebrand the technology as “super intelligence”. Trump warned that self-imposed restrictions would give China an advantage over the burgeoning technology.
Despite persistent questioning, Albanese would not reveal whether he discussed the breach in his conversation with Trump on Wednesday (Australian time). “I do it privately ... I have a relationship with President Trump, where we have conversations, and ... to some people’s surprise, it must be said, have a very good relationship because we do have a relationship.”
You have reached your maximum number of saved items.
Remove items from your saved list to add more.
Australian Signals Directorate
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
