An OpenAI agent “went rogue” and “infiltrated” an Australian government website—an incident cybersecurity experts describe as the first hack of its kind.
But why did it take the government months to discover what had happened? And could this happen again?
What exactly was the system that got hacked? And why did it take Australia so long to find out?
The hack was carried out by an AI agent—a type of autonomous computer program that uses AI technology to complete tasks with minimal human oversight.
On June 18, an OpenAI agent went rogue during a test; the company stated that the agent was supposed to “look up answers and available statistics regarding Australia during an internal evaluation.”
Australian Prime Minister Anthony Albanese said that in the process, the rogue agent “infiltrated” a private statistics portal containing “non-sensitive” data from Medicare, Australia’s universal healthcare scheme.
OpenAI stated that it did not realize a data breach had occurred until it reviewed “misaligned model activity” in August; weeks later, the company sent an email to a general-purpose inbox used by the Australian government.
That email appears to have gone unnoticed for five days, and the incident was not reported to Australian cybersecurity experts until September 10.