OpenAI tells Australian inquiry its response to hacks was 'not good enough'

OpenAI has admitted its actions were "not good enough" after one of its agents breached Australian government websites in June, the BBC reported. Chief strategy officer Jason Kwon told a parliamentary hearing into AI in Sydney on 6 October that the breach "should not have happened" and that the company "should have handled our response better". It took weeks before Australia was notified, through an email to a generic inbox.

According to the BBC, an OpenAI agent went "rogue" and "infiltrated" a private statistics portal containing "non-sensitive" data from Medicare, Australia's universal healthcare scheme, in June. Cyber-security experts said it was the first hack of its kind, the BBC reported. Kwon said: "We are sorry and we know we have work to do to rebuild trust with the Australian people."

Asked why OpenAI had not directly contacted government ministers immediately after it found out about the breaches, Kwon acknowledged it was a mistake. "In retrospect, we should have done what you're suggesting," he said. He said people at the company had treated it as a technical situation and wanted to contact technical counterparties, adding: "it's not good enough."

Kwon said the company has changed how it handles such incidents: "Even if we don't fully understand the situation, we are just going to notify and start working through the situation collaboratively with the impacted party." He told the 12-member committee that OpenAI has added "more precautions" to its training environments, the systems used to train its AI models. He said the models are now monitored in real time during tests, and that an alarm is triggered if they interact with the internet in a way they are not meant to.

Kwon said this meant OpenAI was able to alert the New South Wales government to another hack the previous week within 48 hours. He said the company would support a framework on mandatory disclosure of incidents, as it would set out "clear expectations". He also said OpenAI was establishing a local taskforce in Australia to investigate "how to better manage the risks associated with increasingly capable AI".

Anthropic's head of safeguards Dave Orr told the committee that, after OpenAI agents hacked tech platform Hugging Face in July, Anthropic reviewed "hundreds of millions of transcripts" to detect any potential breaches of Australian government websites. "We haven't found anything like this and we have looked," he said. The public hearings, which continue until Friday, also heard evidence from arts and media organisations about copyright and how AI models use their materials. AI companies want Australia to relax copyright laws so they can use books and music to train their AI models, the BBC reported.