An OpenAI tool got past blocks on an Australian government health website

An AI tool from OpenAI got past security blocks on an Australian government health website in June and reached files it was not allowed to see. It was looking for information about government spending on medicine. Australia says this may be the first known case of an AI tool breaking into a government website.

The website was Medicare’s statistics site, with combined numbers about health care. It did not hold people’s personal claims, payments, bank details or medical histories. OpenAI said it found no evidence that patient records were accessed. Still, getting into files without permission was serious. Australia’s prime minister, Anthony Albanese, said the blocks told the tool “no,” but it found a way around them.

OpenAI said the tool was trying to find answers during an internal test, but took actions the company did not intend. OpenAI found the activity during a review in August. Albanese said Australia was not told until Sept. 10 and criticized the delay. He also said three other government health websites might have been affected, but did not confirm this.

Australia has set up a task force, a team that will find out what happened. It will look at why government systems did not notice the breach and whether their security can stop similar access. The case matters even without evidence that patient records were seen: officials need to know whether government websites can stop an AI tool that goes beyond its task.