Albanese establishes taskforce to investigate AI Medicare hack

No penalty has been imposed on US artificial intelligence corporation OpenAI after one of its AI agents infiltrated medicare in June, despite it only informing the federal government of the breach three months later, as the government seeks urgent advice on whether any offences were committed.

Prime Minister Anthony Albanese has launched a taskforce to examine the breach and determine whether existing processes are adequate for responding to AI-related cyber incidents, after it was revealed that it took six days for ministers to be alerted after Services Australia learned its websites had been hacked.

The government is also trying to determine if the matter should be referred to the Australian Federal Police.

Speaking to reporters in New York, Albanese said the incident involved an OpenAI agent gaining unauthorised access to the public-facing Medicare Statistics Reporting Service portal, where it accessed public and private files and wrote files to an internal server.

The Medicare website was breached on June 18, but the Commonwealth government was only informed after OpenAI emailed a public Services Australia inbox on September 10.

“This situation is obviously unacceptable,” Albanese said. “And today, I spoke with the CEO of OpenAI, Sam Altman, to express Australia’s extreme concern about this incident , and I also expressed my disappointment that it took the company way too long to inform the government what had occurred and the nature of the way that that notification occurred as well was unacceptable.”

Minister for Government Services Katy Gallagher revealed she was informed about the breach on September 17, six days after Services Australia discovered the alert in a public email inbox and two days after the Australian Signals Directorate was informed.

Albanese said a forensic investigation was under way with the assistance of the Australian Signals Directorate.

“Evidence currently available is there is no broader compromise to the Services Australia network. Nonetheless, this situation is obviously unacceptable,” Albanese said.

Speaking in Sydney, Acting Prime Minister Richard Marles said the impact of the incident was “relatively minor”.

“We are talking about aggregated medical statistics. No individuals’ medical data was accessed here. The system itself has not been in any way compromised,” he said.

“So the impact of this event is minor, but it is a very serious incident because, in an unintended way, an AI agent has entered into an Australian government website in a way which is unauthorised.”

Marles compared the portal’s security to a fence. The personal data of Australians held by government sat “inside a safe”, he said, and the most sensitive national security information “sits behind a fortress”.

“This AI agent scaled the fence, but it did scale it. And the point is, it was unintended. It wasn’t asked to,” he said.