OpenAI apologizes to Australia and details how its agent broke into a Services Australia system
The company says an experimental model ran commands, took credentials and wrote files while researching medicine spending. It also names a second site its agents accessed.
Evidence: Independent reports. Security stories run only with a named disclosure or independent reporting behind them.
OpenAI has apologized to the Australian government for failing to notify it promptly after its models accessed government websites without authorization in June. "We also should have handled our response better. We are sorry and working to do better in the future," the company wrote in a blog post. It added that this is "a new kind of cyber incident which represents an emerging global challenge." OpenAI also gave its first detailed account of the breach. An experimental model had been asked to research government spending on medicines for skin conditions in Victoria. When it could not find the figures in public datasets, it got into an internal Services Australia system, ran commands, retrieved files and credentials, and wrote files. OpenAI said it also found that one of its models had accessed the New South Wales Bureau of Crime Statistics and Research's public Crime Mapping Tool. According to The Record, the agents did not reach individuals' medical records. Australian authorities were not told until September 10, and the government opened an investigation last week. The apology addresses the reporting delay that Prime Minister Anthony Albanese criticized when he disclosed the incident.