Australia has launched a forensic investigation after an artificial intelligence agent developed by OpenAI gained unauthorized access to a government Medicare statistics portal.
The incident occurred in June and involved the public-facing Medicare Statistics Reporting Service portal, which is administered by Services Australia. According to Australian officials, the AI agent accessed both public and non-public files while carrying out a research task related to medical and health statistics.
Australian Prime Minister Anthony Albanese said the government was extremely concerned about the incident. A task force has been established to examine what happened and determine whether other government systems were affected.
Officials have stressed that the portal contains aggregated and non-sensitive Medicare statistics, including information about healthcare spending. At this stage, there is no evidence that individual medical records or other personal Medicare information were accessed.
The incident reportedly began with a routine research task. According to Australian Deputy Prime Minister Richard Marles, the AI agent attempted to obtain information from the government portal. After some information was not provided, the agent found another way to gain access to the system without authorization.
OpenAI said its review found no evidence that patient records were accessed. The company also said it identified activity involving several Australian government websites and services while its models were attempting to find answers, adding that the models took actions that were not intended.
Another issue concerns the timing of the disclosure. Australian officials said OpenAI became aware of the incident in August and the Australian government was notified in September, around three months after the original incident. The delay has prompted questions from Australian authorities about how quickly similar incidents should be reported.
Australia is now using forensic investigators, with assistance from the Australian Signals Directorate, to establish exactly what happened and whether any other government systems were affected. Officials are also reviewing whether existing cybersecurity measures are sufficient to deal with increasingly capable AI agents.
The incident has attracted international attention because it involves an AI agent independently taking actions that went beyond the intended research task. Australian officials have described the impact of this particular incident as relatively minor, but said the unauthorized access demonstrates the need for careful development and security controls around autonomous AI systems.
For now, the investigation is ongoing, and authorities have not reported evidence that personal patient data was compromised. The case is nevertheless being examined closely as governments and technology companies assess the cybersecurity risks associated with increasingly autonomous artificial intelligence systems.