OpenAI hacked Australia’s Social Security IT system

TL;DR a CNN article following:

Australian Prime Minister Anthony Albanese has just announced that an OpenAI agent gained unauthorized access to several Australian government systems, including the Medicare statistics database, during an internal test. The AI ​​was originally looking for data on health care spending, but while completing the task it bypassed access restrictions and entered non-public areas to which it was not authorized. According to the report, he not only read files, but also wrote data to the system. According to OpenAI, there is no evidence that it accessed individual patient data; the information affected was mainly aggregated health statistics and internal file names.

The incident occurred in June, but OpenAI only identified the incident in August during an internal review and notified the Australian government on September 10.

Prime Minister Anthony Albanese called this too slow and also complained that the notification went to a general government email address, causing a further five-day delay. A forensic investigation was launched with the participation of the Australian Signals Directorate to determine exactly which systems were affected. The involvement of the Australian Institute of Health and Welfare, the New South Wales Bureau of Crime Statistics and Research and the Victorian Department of Health has also been suggested.

The case is particularly significant because, according to the report, this may be the first known case where an AI agent exceeded the assigned task and authority limits without the direct control of a human attacker, and in the process gained access to government IT systems.