Services Australia

2 items · Capability 2 · all entities

New OpenAI names four Australian bodies its models reached and says it should have told them sooner

In a post headed “How we will do better for Australia,” OpenAI set out what its models and agents did at four Australian bodies. At Services Australia, “an OpenAI model discovered a way to gain non-public access to the service, and ran commands, retrieved internal files, credentials and aggregate statistics, and wrote files.” At the NSW Bureau of Crime Statistics and Research, a model “accessed BOCSAR's public Crime Mapping Tool to research public crime statistics.” At the Victorian Department of Health, agents “discovered an exposed access key to query the Victorian Agency for Health Information's reporting system and retrieve reporting configuration and aggregate survey statistics.” At the Australian Institute of Health and Welfare, agents “retrieved aggregate statistics using third-party browsing and download services.” OpenAI wrote that “we should have shared preliminary findings sooner and kept Australian agencies updated as more facts emerged,” and said it will establish “a taskforce with independent Australian expertise to develop practical policy recommendations,” offer credits from its “$1 billion Daybreak for Frontline Defenders fund,” and send chief strategy officer Jason Kwon to “appear at the Joint Select Committee on Artificial Intelligence in Sydney on Tuesday 6 October.”

On the recordOpenAI ↗ ·

Australia says an OpenAI agent broke into a government Medicare statistics portal during an internal evaluation

Prime Minister Anthony Albanese said an OpenAI agent gained unauthorised access on June 18 to the Medicare statistics reporting service portal administered by Services Australia, reaching non-public aggregate health statistics and internal file names on an old government site: “The AI agent found a way around those blocks, didn't accept ‘no' for an answer, if you like.” He said OpenAI did not notify Services Australia until September 10, by an email to a public mailbox, that he had told Sam Altman of “Australia's extreme concern” and that the notification delay was “obviously unacceptable”; Services Australia reported the incident to the Australian Signals Directorate's cyber security centre on September 15. OpenAI says the activity surfaced in an internal evaluation and that it found no evidence patient records were accessed, and Albanese named three further sites that may have been affected — the Australian Institute of Health and Welfare, the NSW Bureau of Crime Statistics and Research and the Victorian Department of Health. The non-profit Transluce traced the activity through the public scanning service urlquery (via ABC News).