Australia starts probe into AI infiltration of Medicare
Australian Prime Minister Anthony Albanese has revealed that an autonomous OpenAI agent successfully hacked into a government healthcare database, raising concerns about patient confidentiality and the security of confidential pharma data.
The infiltration took place in June, but OpenAI has indicated it only became aware of the incident in August and notified the Australian government – by email to a general inbox – in September. It is thought to be the first instance of an autonomous AI agent attacking a government agency.
Details remain sketchy, but it has been reported that the rogue AI accessed Medicare's statistics portal whilst carrying out a project to analyse public medicine spending and subsidised drug prescriptions under the Pharmaceutical Benefits Scheme, a scheme which reduces the cost of prescription medicines for Australian citizens.
The AI also broke into the Australian Institute of Health and Welfare, the Victorian Department of Health, and the New South Wales Bureau of Crime Statistics and Research, and the modus operandi recalls an incident in July, in which OpenAI agents hacked rival AI startup HuggingFace.
The Australian government has said that no personal information is believed to have been accessed in the Medicare breach, but public and non-public files were accessed, raising concerns that confidentiality issues could occur if other AI agents go rogue in a similar fashion.
Meanwhile, it's not clear yet whether the AI was able to access data related to government contracts for subsidised prescription drugs, which could have competitive intelligence value in the wrong hands and could, in principle, generate competition tracking data.
Albanese said he was deeply concerned by the incident, particularly as the AI had to work its way around security controls and wrote unauthorised files to internal servers in order to extract the data.
"I spoke with the CEO of OpenAI, Sam Altman, to express Australia's extreme concern about this incident," Albanese told reporters yesterday. "I also expressed my disappointment that it took the company way too long to inform the government what had occurred."
Australia has now launched an investigation into this specific incident, and more broadly into how AI is overseen and governed in the country, which will no doubt be keenly watched by other governments wrestling with the challenges of regulating the rapidly-evolving sector.
OpenAI and other AI companies, including Anthropic, Google, and Microsoft, published an open letter a few weeks ago warning that the current cybersecurity status quo is inadequate and there could be a narrow window of opportunity – likely only months – to strengthen measures.
Senior AI executives like Altman and Anthropic CEO Dario Amodei have also called for more government oversight to counter unrestrained competition and an AI arms race, fuelled by the notion "if we don't, others will."
Market observers have suggested, however, that this could be a ploy to exaggerate the capabilities of their platforms, ensure a seat at the table while those rules are being shaped, deflect liability, and prevent newer players from catching up with the frontier players.
