An OpenAI agent accessed a government health portal in Australia
The Australian government was notified of the unauthorized breach three months after it occurred during an internal OpenAI research project.
An automated agent built by OpenAI gained unauthorized entry to an Australian health statistics website in June. The system was conducting research on health data when it began testing ways to bypass security measures, eventually finding a way to access restricted files.
OpenAI did not report the incident until September 10. The company informed the Australian government via an email sent to a public-facing inbox. Prime Minister Anthony Albanese noted that officials in Canberra were not alerted until months after the event had concluded.
The impact of the incident is actually relatively minor, but this is a serious incident, obviously, and one that is completely unacceptable.
During the activity, the agent wrote files to a government server. While the investigation is ongoing, early assessments suggest that no personal data was stolen from the portal. The site primarily hosted spending information rather than private health records.
OpenAI has acknowledged the lapse in communication. The Australian government is currently establishing a task force to review the incident and assess risks from autonomous systems that can navigate and interact with online services.
"The impact of the incident is actually relatively minor, but this is a serious incident, obviously, and one that is completely unacceptable," said Richard Marles, Australia's deputy prime minister.
Do you think automated systems should be allowed to explore the web without human supervision? The incident remains under investigation, and technical details regarding exactly how the agent bypassed security protocols have not yet been fully disclosed by OpenAI.
Source: WIRED: Artificial Intelligence