OpenAI Medicare breach prompts urgent government cybersecurity overhaul

The OpenAI Medicare breach has prompted an urgent bolstering of government cyber systems to ensure resistance against AI threats.

New details have also been revealed about OpenAI's notification to the government, sent months after its agent went rogue and gained unauthorised access to the Medicare statistics portal administered by Services Australia.

Following the incident all government departments and agencies have been required to take stock of how their systems may be exposed to risks posed by AI and other emerging technologies.

On Wednesday Home Affairs issued a directive advising departments to target older software and technology.

Systems of Government Significance will be prioritised and a review is due by the end of the year.

Less vital systems will be assessed by the end of March next year.

Acting Home Affairs Minister Richard Marles stressed the importance of constantly reviewing the systems in a rapidly changing environment.

"AI is changing the environment in which we operate at extraordinary speed. Government systems need to keep up," he said in a statement.

"We can't wait for an old system to fail before replacing it. We need to identify vulnerabilities and deal with them before they can be exploited."

The breach has sharpened Labor's plans to impose reporting requirements on artificial intelligence companies.

Australia is set to introduce legislation for national standards to put "guardrails on AI", which would include mandatory standards for data centres, before the end of the year.

A rapid review into the OpenAI breach is due to conclude within weeks and the findings are expected to inform the national standards.

New details about OpenAI government disclosure

OpenAI has faced scrutiny over the two-month delay in informing the government about the Services Australia breach, as well the nature of the disclosure.

The website targeted was a legacy system that has since been shut down, with the data moved to a more secure address.

A copy of the letter obtained by ABC reveals the framing to the government, which was notified of "security vulnerability identified" during a review of the agent's activity.

"An OpenAI model identified a way to make the server carry out instructions sent through the public reporting interface, without a private account or password," the notification said.

"It was able to access this to read portions of internal program files and settings, obtain a list of files, and create and read back a small test file on the server."

OpenAI has since admitted the agent took actions the company "did not intend" during the incident.

On Tuesday the ChatGPT maker apologised for the breach, which was carried out by an internal-only model that did not have the safeguards used in publicly available products.

In a blog post on OpenAI's website, the company said it intended to "rebuild trust with the Australian people".

"We are sorry and working to do better in the future," the post said.

"This is a new kind of cyber incident which represents an emerging global challenge."