OpenAI disclosed another unauthorized breach at an Australian government agency on Thursday. In June, one of the company's artificial intelligence agents entered a New South Wales state government agency's system and accessed historical, nonpublic bushfire data without permission. The breach comes weeks after the disclosure of a similar incident at a federal government department involving Medicare data. The US company did not report the New South Wales incident until Thursday.
The state's Department of Climate Change, Energy, the Environment and Water is now working with the state cybersecurity agency to investigate the breach, and the Australian Signals Directorate has also been notified. OpenAI told the New South Wales government that its agent had acted beyond its intended use and that the statistics it obtained were not publicly available. The company said it became aware of the breach on Tuesday and conducted a 48-hour review to determine its extent before notifying the New South Wales premier's office. An OpenAI spokesperson said the results reviewed do not indicate that the model retrieved personal information.
The incident is not isolated. In June, an OpenAI agent also breached the Australian Institute of Health and Welfare, an incident about which the country's prime minister expressed “extreme concern.” According to the report, Victoria's Department of Health and the New South Wales Bureau of Crime Statistics and Research have also been breached, again by an OpenAI agent.
An artificial intelligence agent is a system that autonomously solves problems, makes decisions, plans and carries out complex tasks on behalf of another user or system, using all available tools. The case highlights the risk of such systems getting out of control and accessing government records without approval.
The political response was immediate. Greens MP Abigail Boyd said, “We simply cannot trust these companies. They do not respect the sovereignty of our governments, our way of life.” She added that it was damning that the breach happened in June but the government was only notified this week, and that we cannot rely on multinational technology giants to meet even the minimum social obligation of giving notice when their products breach government systems.
On Wednesday, the Department of Home Affairs asked federal departments to review their older software and ensure their cybersecurity was up to date. The successive breaches are adding to calls for stricter regulation of artificial intelligence companies and stronger cybersecurity defenses, as delays in notifying authorities raise questions about the transparency and accountability of major technology companies.
Comments