Australia probes OpenAI over government health site hack

The disclosure comes as governments and tech companies grapple with how to rein in increasingly autonomous AI, after a recent spate of AI agents breaking out of their sandboxes, colluding on the internet, and posing cybersecurity issues. The Australian incident is the first publicly reported case of an AI model hacking into a government's systems.

The breach began on June 18, but OpenAI did not notify the government until September 10. OpenAI says it only learned of the incident in August, when it surfaced during a broader, companywide review of agents behaving in unintended ways. Albanese said OpenAI disclosed the breach by sending a notification to the public mailbox of Services Australia, which then notified Australia's Cyber Security Centre five days later. The prime minister said he raised the matter directly with OpenAI chief executive Sam Altman, stressing Australia's "extreme concern" and "disappointment."

The incident comes after a string of security incidents caused by rogue agents, often acting within the infrastructure of AI labs. In July, swarms of OpenAI agents breached Hugging Face, and since then, more incidents of AI agent hacks from Anthropic, Meta, and Google have been revealed. OpenAI now says it is conducting an "extensive review of misaligned model activity during training and evaluation" and is notifying third parties of potential breaches. Whether the Australian investigation leads to law enforcement or legislative action may depend on whether the breach is connected to the earlier German wiki site breach that ABC News reported, and on the findings of OpenAI's own review.