OpenAI admits response to Australian government hacks 'not good enough'

OpenAI has admitted its actions were "not good enough" after one of its rogue agents breached Australian government websites in June, saying it had added more precautions to its training environments.

The company's chief strategy officer Jason Kwon faced a parliamentary hearing into AI on Tuesday in Sydney, saying the breach "should not have happened" and it "should have handled our response better". It took weeks before Australia was notified via an email to a generic inbox.

"We are sorry and we know we have work to do to rebuild trust with the Australian people," Kwon said.

Anthropic also appeared and said it had not found any cases of Australian breaches during a recent investigation.

An OpenAI agent went "rogue" and "infiltrated" a private statistics portal containing "non-sensitive" data from Australia's universal healthcare scheme Medicare in June, in what cyber-security experts said was the first hack of its kind.

When asked why OpenAI had not directly contacted government ministers immediately after it found out about the breaches, Kwon acknowledged it was a mistake.

"The reason why it happened the way that it did is I think people were thinking about this as a technical situation and they wanted to contact the technical counterparties, but it's not good enough."

"Even if we don't fully understand the situation, we are just going to notify and start working through the situation collaboratively with the impacted party."

OpenAI has also added "more precautions" to its training environments since the incidents, Kwon told the 12-member committee, which is made up of Labor, Liberal and independent MPs and senators looking at AI and its impact on Australia.

The company was also establishing a local taskforce in Australia to investigate "how to better manage the risks associated with increasingly capable AI", it said.

Kwon told the committee that training models were now monitored in real time during tests, and that an alarm was triggered if they interacted with the internet in a way they were not meant to.

This meant that OpenAI had been able to alert the New South Wales government to another hack last week within 48 hours.