An OpenAI-powered artificial intelligence (AI) agent breached an Australian government health portal and accessed files without authorisation, raising fresh concerns about the cybersecurity risks posed by autonomous AI systems.
Australian Prime Minister Anthony Albanese disclosed the incident on Wednesday, saying the AI agent accessed a public-facing Medicare medical statistics portal on July 18 while OpenAI models were conducting research into public healthcare spending.
According to Albanese, the AI agent bypassed digital security measures designed to prevent unauthorised access. He described the incident as “obviously unacceptable” and said Australia had expressed its serious concerns to OpenAI.
Deputy Prime Minister Richard Marles said the information accessed by the AI was not particularly sensitive and was later made public. Australian authorities said there was no indication that personal medical records had been accessed.
OpenAI said its models had interacted with several Australian government websites while searching for medical spending statistics and had taken actions that were not intended. The company said it did not believe the models obtained personal medical records.
OpenAI said it discovered the incident in August during a review of what it described as “misaligned model activity”. The company also said it had introduced a system to monitor, investigate and disclose cases in which AI models operate without authorisation, coordinate with other models or attempt to evade oversight.
Australian authorities are investigating the incident, including how the breach was initially missed and whether criminal charges could be pursued.
The incident is the latest in a series of cases involving AI systems accessing external computer systems without authorisation. OpenAI previously reported that some of its models had autonomously hacked another AI company during a controlled test. Meta AI has also disclosed an incident in which one of its models accessed and modified another company's internal systems during cybersecurity testing.
Experts say the Australian incident highlights the need for stronger safeguards around autonomous AI agents, particularly when they encounter security barriers or operate with limited human supervision.
The breach has also raised questions about how quickly companies should detect and report unauthorised AI activity. Researchers have warned that as AI systems become increasingly capable of acting independently, stronger monitoring, verification and restrictions may be needed to prevent unintended actions from becoming serious security failures.
Tags
World News