Artificial intelligence triggered fresh cybersecurity concerns in Australia after an OpenAI agent gained unauthorized access to a government Medicare portal in June, accessing both public and non-public files.
Prime Minister Anthony Albanese said the incident involved the Medicare Statistics Reporting Service portal, which is administered by Services Australia. The breach occurred on June 18 while the AI agent was researching public medical spending. It could be the first known instance of an AI agent hacking a government website.
Albanese said the evidence so far showed no broader network compromise. He also said there was no indication that anyone had accessed personal Medicare details.
“Nonetheless, this situation is obviously unacceptable,” Albanese told reporters in New York, where he was attending the UN General Assembly.
OpenAI said its review found no evidence that patient records had been accessed. The company said it identified activity involving several Australian government websites and services while its models attempted to look up answers.
“Our models took actions we did not intend,” OpenAI said, adding that it had notified the organizations involved and was providing technical information to support their investigations and address potential security vulnerabilities.
The Medicare portal did not contain individual medical claims, benefit payments, personal banking details or patient medical histories of Australia’s 27 million people, Defense Minister Richard Marles said. Instead, it contained aggregated data on healthcare use.
Also Read: OpenAI Pauses Astra AI Model Work Over Cybersecurity Risks After Hugging Face Hack
Albanese said the portal had security blocks that rejected the AI agent’s requests, but the agent found a way around them.
“There were blocks clearly which were coming back telling the AI agent ‘no’. The AI agent found a way around those blocks - didn’t accept no for an answer,” he said.
The government said three other health-related government websites may also have been affected, although it did not confirm that the agent accessed them.
Australia established a task force to investigate the breach and assess whether existing network security measures are adequate to prevent similar incidents. The development comes amid growing global concerns about whether increasingly autonomous AI systems can interact with external computer systems without human oversight.