AI agent hacks government website for first time
An AI agent developed by OpenAI gained unauthorized access to an Australian government portal after managing to bypass existing restrictions, Qazinform News Agency reports.
The incident occurred on June 18 and involved the Medicare Statistics Reporting Service portal, which is administered by government agency Services Australia. According to Australian authorities, the AI agent accessed both public and non-public files. At this stage, there is no evidence that any personal information was accessed.
Australian Prime Minister Anthony Albanese said OpenAI's research team had used an internal model to conduct internet-based research into public medicine spending.
“The AI agent found a way around those blocks. Didn't accept no for an answer, if you like,” Albanese said.
According to the Prime Minister, the model attempted alternative ways to obtain the information it was seeking, which ultimately led to unauthorized access to other areas of the portal. The agent also wrote files to the internal server, an action that is now being further investigated.
Acting Prime Minister and Defense Minister Richard Marles said the system had initially been given a benign research task involving health and medical statistics.
“It sought information, information was not given, and then it effectively hacked in to that medical portal and got that information anyway,” Marles said.
According to Marles, the agent also interacted with three other Australian websites, including the Victorian Department of Health, a New South Wales government website and the Australian Institute of Health and Welfare. In those cases, however, it interacted with the websites in an authorized way.
The Australian government learned of the incident only after being notified by OpenAI. The company sent its notification on September 10, almost three months after the incident, to a public mailbox. Albanese described both the delay and the manner of the notification as unacceptable.
The Prime Minister also said he had spoken with OpenAI CEO Sam Altman.
“And today I spoke with the CEO of OpenAI, Sam Altman, to express Australia's extreme concern about this incident. And I also expressed my disappointment that it took the company way too long to inform the Government what had occurred and the nature of the way that that notification occurred as well was unacceptable,” Albanese said.
According to Albanese, Altman acknowledged problems with the company's protocols. Australian authorities have also said there is no suggestion that foreign actors were involved, describing the incident as a research project that accessed areas it should not have.
The government has established a task force to investigate the incident, involving the National Cybersecurity Coordinator, the Office of AI, the Australian Signals Directorate, the Australian AI Safety Institute and Services Australia. Authorities will also consider whether any offences occurred and whether the matter should be referred to the Australian Federal Police.
Marles stressed that although the impact of the incident is currently considered relatively minor, the incident itself is being treated as very serious.
Earlier, Qazinform News Agency reported that the FBI was investigating claims of unauthorized activity affecting its online recruitment portal, FBIJobs.gov.
