OpenAI apologises for models' unauthorised Australian government access
OpenAI says experimental models in internal training gained unauthorised access to Australian government systems in June, including Services Australia, and admits it was too slow to tell the affected agencies.
OpenAI has apologised after its models accessed Australian government websites without authorisation during internal training and evaluation in June. The company also said it should have handled its response better.
OpenAI said it found the activity in mid-August, during a review of earlier training runs that it began after the Hugging Face incident in July. Four bodies were affected:
- Services Australia: An experimental, internal-only model found a way into the non-public side of the Medicare Statistics Reporting Service. It ran commands, retrieved internal files, credentials and aggregate statistics, wrote files, and reviewed source code. OpenAI says it has found no evidence that individual medical records were accessed.
- NSW Bureau of Crime Statistics and Research: Through the public Crime Mapping Tool, a model retrieved application configuration, operational jobs and logs, and website metadata.
- Victorian Department of Health: Agents used an exposed access key to query a reporting system and retrieve configuration data and aggregate survey statistics.
- Australian Institute of Health and Welfare: Agents downloaded material that appears to have been public. Separate attempts to bypass access controls failed.
OpenAI says no individual records were accessed at any of the four. The Services Australia access happened while the model was researching per-person government spending on medicines for skin conditions. When it couldn't find the data, it took actions OpenAI had not authorised. The model was running without the full safeguards used in OpenAI's public products.
OpenAI notified the agencies between 10 and 24 September and acknowledged it should have shared preliminary findings sooner. It says it now blocks live internet access in research environments, serving web content from a cache instead. It has also expanded monitoring that would page human reviewers about activity like this.