OpenAI apologises for Medicare breach

OpenAI has apologised and committed to ‘do better’ after an AI model it set up to research Medicare statistics gained unauthorised access to the Services Australia online reports portal.
 
On Monday, it said its OpenAI model ‘discovered a way to gain non-public access to the service, and ran commands, retrieved internal files, credentials and aggregate statistics, and wrote files’.
 
The company said its ‘experimental, internal-only OpenAI model’, which was not intended for public release and did not have the full set of safeguards used in publicly available products, was tasked with looking into spending per person on medicines for skin conditions in Victoria.
 
‘The model had difficulty obtaining that information, and it took actions that we had not authorised it to take,’ OpenAI said.
 
‘In the course of looking for this information at Services Australia’s Medicare Statistics Reporting Service, it discovered a way to gain non-public access to the service.
 
‘It then used this access to review technical system information and source code related to the service – all still with the objective of trying to find the information it was originally looking for.
 
‘We did not intend for this activity to occur, and the access to the service and follow-on activity should not have happened.’
 
It said its review ‘to date has found no evidence that anyone’s medical records were accessed’.
 
Dr Sean Stevens, Chair of RACGP Specific Interests Digital Health and Innovation, told newsGP the company’s apology is welcome.
 
‘They certainly do need to do better,’ he said.
 
‘It sounds like OpenAI are playing catch-up almost as much as the rest of us as far as these agents go.
 
‘I really hope that they do take what’s happened very, very seriously.’
 
Dr Stevens said it is ‘a very timely warning that cybersecurity is only going to become more and more important’.
 
‘Just about every general practice in Australia would have a public-facing website and needs to review all of their cybersecurity and make sure it’s as robust as it can be,’ he said.

OpenAI realised the breach in August and notified Services Australia via a public email address on 10 September.
 
On Monday, it acknowledged the company ‘should have handled our response better’. 
 
‘This looks like there was no patient data breached, which is good, but you don’t want to wait until it gets to the point where patient data is breached,’ Dr Stevens said.
 
‘I do hope that their liaison with authorities right around the world is better than what we’ve seen in this episode.’
 
OpenAI also gave more detail on other incidents affecting Australian government websites, including the NSW Bureau of Crime Statistics and Research and the Victorian Department of Health. It said there was ‘no system compromise’ in OpenAI research involving the Australian Institute of Health and Welfare website.
 
Last week, Prime Minister Anthony Albanese revealed the Services Australia breach while in New York for the UN General Assembly, and said he had expressed Australia’s ‘extreme concern’ to OpenAI CEO Sam Altman.
 
A high alert was subsequently published by the Australian Signals Directorate for ‘all Australian organisations with public-facing websites or applications’, advising action within 48 hours.
 
On Tuesday, Prime Minister Albanese said OpenAI had been ‘very constructive and open in engaging’ with the Government taskforce now looking into the incidents.
 
‘This is a challenge that the world is dealing with,’ he said.
 
‘Artificial intelligence can improve economic growth, improve our productivity. It can make a big difference for businesses who are using it.
 
‘But there are risks and we've seen those risks exposed, not just in what occurred in Australia, but the revelation that that has occurred in the United States and other countries as well. So, we need to work this through.’
 
Dr Stevens said the OpenAI Medicare breach is ‘not the first of these events, and I’m sure it’s not going to be the last’.
 
‘I really hope that we can come to some international consensus around how to manage this emerging threat,’ he said.
 
Log in below to join the conversation.

cybersecurity Medicare OpenAI