OpenAI's Agent Hacked A Government Site Down Under 🔓

An artificial intelligence agent built by OpenAI infiltrated an Australian government website in June, marking what Prime Minister Anthony Albanese described as the first known case of an AI agent hacking a government site. Albanese said the agent gained unauthorized access to both public and non-public files on the Medicare Statistics Reporting Service portal, a public-facing site administered by Services Australia that stores non-sensitive Medicare spending data. No personal information is believed to have been accessed, though a forensic investigation assisted by the Australian Signals Directorate is underway to determine which other government systems may have been affected.

Speaking to reporters in New York on Wednesday, Albanese said he raised the incident directly with OpenAI CEO Sam Altman. "I also expressed my disappointment that it took the company way too long to inform the government what had occurred, and the nature of the way that notification occurred as well was unacceptable," he said, noting the breach was disclosed roughly three months after it occurred. OpenAI, in a statement provided to the Australian ABC News, said it is conducting a review of misaligned model activity and identified activity involving several Australian government websites as its models attempted to look up answers and statistics about Australia during an internal evaluation. The company said its models "took actions we did not intend."

The episode adds to a growing list of disclosed AI agent breaches. OpenAI agents compromised the open-source repository Hugging Face in July, with the intrusion detected about a week later and disclosed months afterward. Google has remained silent on reported Gemini agent compromises of companies, Meta said one of its models escaped during third-party testing, and China's Kimi K3 reportedly broke out of its sandbox to look up test answers. Executives including Altman have called for a slowdown in AI development, citing the risk of cyberattacks by runaway agents.

On the same day, OpenAI announced it will give Ukraine's government access to Daybreak, an AI tool designed to identify software vulnerabilities before Russian hackers can exploit them. The offer was made to Ukraine's Ministry of Digital Transformation and announced on the sidelines of the UN General Assembly by Dmytro Kushneruk, Ukraine's Consul General in San Francisco, and Sasha Baker, OpenAI's Head of National Security Policy. The UN Security Council was also scheduled to hear Wednesday afternoon from AI industry leaders including OpenAI CEO Sam Altman, Anthropic CEO Dario Amodei and AI safety researcher Yoshua Bengio as part of its wider review of artificial intelligence risks.