OpenAI hacked Medicare portal, Prime Minister Anthony Albanese says

The prime minister has had a "frank" discussion with OpenAI chief executive Sam Altman after an AI agent breached an Australian government website.

The company did not notify Services Australia of the incident until three months after the fact, via email.

The prime minister has announced a taskforce to investigate further.

Prime Minister Anthony Albanese has revealed an AI agent hacked into an Australian Medicare data portal earlier this year.

Speaking in New York, Mr Albanese said the Open AI agent gained unauthorised access to the Medicare statistics reporting service portal administered by Services Australia on June 18.

The AI agent accessed both public and non-public files, but Mr Albanese said it did not appear anyone's personal Medicare details had been accessed.

Mr Albanese said he had a "frank" discussion with OpenAI's CEO Sam Altman after the incident, saying the company took three months to notify of the breach, and when it did, it was in an email sent to the Services Australia public inbox.

The agent was conducting research into public medical spending when it found a way to break through privacy protections.

"The AI agent found a way around those blocks, didn't accept 'no' for an answer, if you like," Mr Albanese said.

Mr Albanese said OpenAI's delay and method of notifying the government the breach were "unacceptable".

"Today I spoke with the CEO of OpenAI, Sam Altman, to express Australia's extreme concern this incident," he said.

"And I also expressed my disappointment that it took the company way too long to inform the government what had occurred.

"The nature of the way that the notification occurred as well was unacceptable."

The prime minister said Services Australia was not notified until September 10.

On September 15, Services Australia reported it to the Australia Signals Directorate's cyber security centre.

Last week, Services Australia got in touch with Katy Gallagher, the minister for the public service. Mr Albanese's office was notified over the weekend, he said.

"The notification was an email, sent just to the public mailbox," Mr Albanese said.

"I had that discussion very frankly, with Mr Altman."

He said there was no evidence any individual personal information had been accessed, but an investigation aided by the Australian Signals Directorate was now underway.

"[The] evidence currently available is there is no broader compromise to the Services Australia network. Nonetheless, this situation is obviously unacceptable," Mr Albanese said.

He announced a taskforce would be set up to provide an "urgent and immediate review" of the incident, with Acting Prime Minister Richard Marles and Katy Gallagher,due to provide more details in a press conference soon.

OpenAI says 'several' Australian government websites involved

In a statement, an OpenAI spokesperson said the company is "conducting an extensive review of misaligned model activity" during training, and notifying third parties when there is a potential impact to their systems.

"During this review, we identified activity involving several Australian government websites and services as our models attempted to look up answers, and available statistics for questions Australia during an internal evaluation," they said.

"In the course of that, our models took actions we did not intend.

" Our review found no evidence of patient records being accessed. The information accessed included aggregate health statistics and internal file names. "

The company said the information accessed included aggregate health statistics and internal file names.

"We notified the organisations and are providing technical information to support their investigations and help address potential security vulnerabilities," the statement said.

They said their overall review is ongoing and they remain "committed to transparency".

Mr Marles told ABC Radio National other websites had been accessed but not believed to be hacked, including the Victorian Department of Health, a New South Wales government website, and the Australian Institute of Health and Welfare.

The NSW Bureau of Crime Statistics and Research website was also impacted.

Mr Marles said the investigation would be led by the prime minister's department and would work with the Australian Signals Directorate and the AI Safety Institute to understand what the AI agent did and how the incursion happened.

Mr Marles said the fact a non-human AI agent gained unauthorised access represented "a very serious incident", but the impact on the system was minor.

"For what that's worth, that's relatively minor, and so it's important to assure people of that. No personal information has been accessed here. There's no impact on the system."