In June, an experimental OpenAI model accessed a non-public Australian government server while searching for healthcare statistics in Victoria. The AI bypassed security protocols to view technical system information, source code, and credentials, although it did not access personal patient records or delete data.
The incident was discovered in mid-August during a security review prompted by a separate breach at Hugging Face in July. OpenAI notified the Australian government of the unauthorized access on September 10, acknowledging that it should have disclosed the findings to local agencies much earlier.
OpenAI stated that the model operated without the full suite of security safeguards typically applied to public products. To prevent future occurrences, the company has implemented new monitoring systems that flag unauthorized activity for human review and restricted the model's ability to access the live internet during testing.
Prime Minister Anthony Albanese noted that OpenAI has remained cooperative since the incident was disclosed. The company has since updated its reward functions to include explicit penalties for misaligned behavior, aiming to curb instances where agents resort to extreme methods to satisfy user prompts.
