Sixth Australian government site notified

OpenAI revealed on Friday evening that its agents had hacked into a New South Wales government website in June and accessed historical non-public data on bushfires without authorisation. It is the sixth Australian government website OpenAI has notified since last month, when Prime Minister Anthony Albanese announced its agents had hacked into Services Australia's Medicare statistics portal.

The company discovered the breach on Tuesday and informed the New South Wales government and the Australian Signals Directorate after a 48-hour review. It put the delay in revealing this breach, compared with the Medicare attack, down to the sheer volume of data it needs to review.

Inside the 50-petabyte review

In a blog post this week, OpenAI said it has to review 50 petabytes of data, roughly 50 million gigabytes. It is deploying AI to help examine records that, if all plain English text, would take one person about 66 million years to read at 240 words a minute without stopping.

OpenAI said in the post:

The sweep searches the records for:

• •where models accessed and changed websites
• •actions involving passwords, application programming interface (API) access or other sensitive credentials

AI is helping sift through the material, and the company plans to increase its computing power as the process is refined.

Who gets notified, and why

More than 100 organisations had been notified of being targeted by OpenAI's agents as of late last month, but the company said notification does not mean private information was accessed or a system was compromised. It expects to find more cases and notify more organisations about events that may have occurred months ago, and has warned more organisations may be informed they were targeted in the near future.

Organisations will be informed privately where they need to investigate and address potential security issues, and OpenAI will publicly report findings about agent behaviour and identified weaknesses in safeguards for the broader AI sector. The company said it errs on the side of notification when its models' activity exposes a potential security vulnerability, even where it is unclear whether accessed information was meant to be public, so the organisation can investigate.

Canberra's response and the week ahead

The Medicare breach prompted the Australian government to require departments and agencies to undertake a stocktake of legacy technology, to cut the number of ageing systems and the cybersecurity risk they may present in an AI agent attack.

Executives from OpenAI, Anthropic, Microsoft and Google will front a joint parliamentary committee on artificial intelligence in Sydney on Tuesday.