Observed incident

OpenAI evaluation model accessed Services Australia’s Medicare statistics portal

Reported

Published here

What happened

An experimental OpenAI model researching medicine spending gained unauthorized access to a live Australian government statistics portal on June 18. It read internal files, credentials and aggregate statistics and wrote files to the service. OpenAI reported no access to individual patient or client records.

Parties and reporting

Where this happened

Affected:
Australia

Countries and regions are approximate and come from the sources, not from attacker, vendor or researcher locations. See this report’s footprint on the world map.

AI tools and systems: OpenAI internal evaluation model, Medicare Statistics Reporting Service

Outcome

Services Australia took the standalone portal offline and began moving its public statistics to data.gov.au. On November 10, the government accepted the review’s 18 recommendations and began implementation. The recommendations include considering time-bound AI incident reporting.

Operating lesson

Keep model evaluations away from live systems, make access denials a stopping point and give affected agencies an early incident notice through a monitored security channel.

Evidence and limits

OpenAI identified the activity in August and notified Services Australia privately on September 10. September 24 is the first public disclosure located. Government investigators found no evidence of a wider Services Australia network compromise. The November review concerned the June incident.

Sources