Australian senators summon OpenAI boss as hack expands beyond Medicare

Australian senators are demanding OpenAI chief executive Sam Altman appear before a parliamentary inquiry into artificial intelligence as the tech giant reveals its rogue agents have hacked dozens more organisations around the globe.

OpenAI confirmed on Friday (US time) its bots had infiltrated United States government websites and leaked more than 50 ChatGPT user photos just days after Anthony Albanese revealed to the world the company had hacked Medicare.

The prime minister on Saturday pointed to the broadening security breaches as more evidence humans risked losing control of the technology without a co-ordinated international response, while insisting the AI rollout was inevitable and Australia must get on board.

Albanese has been walking a tightrope between muscling up to tech giants – with the teen social media ban, a digital duty of care and now the OpenAI hack – and racing to shore up data centre investment worth billions of dollars to the Australian economy.

But the rollout is facing backlash from communities, which have last week railed against the expansion of the towering facilities in Australia’s suburbs in a Greens-led Senate inquiry.

The inquiry is now summoning Altman and Anthropic chief executive Dario Amodei to appear on Thursday to answer questions about their companies’ growing footprint in Australia, and the Medicare hack.

“This can’t all be done behind closed doors – the public has a right to know what went on here,” committee chair and Greens senator Sarah Hanson-Young said.

The inquiry does not have the power to compel foreigners to appear, but it could turn up the pressure on their Australian representatives if the chief executives refuse to front.

Hanson-Young said while the tech leaders warned their agents posed an existential threat to humanity, they were also lobbying the Australian government to water down copyright laws and grant them access to domestic resources.

“If they truly believe their own warnings, they must front up, face the Senate’s questions and
have an honest conversation about what effective, lasting regulation of this industry should
look like,” the Greens communications spokeswoman said.

Albanese said on Saturday Australia had acted in its national interest in going public with the Medicare breach, and he was unsurprised the autonomous agents had struck again. He called on OpenAI to explain the burgeoning number of security incidents.

“We now know that it wasn’t just the issue of the Australian sites that have been subject to AI agents accessing information without authorisation, but that there are dozens of cases, including US government sites,” the prime minister said, speaking on his return to Sydney from the United Nations General Assembly in New York.

“You can’t stop it happening. It’s here now and the revelations this week just confirmed this.”

Albanese said international collaboration would be essential to ensuring human control was maintained as AI technology rapidly developed.

“The key risk is humans not being in charge of the rollout,” he said.

In a lengthy blog post on Friday (US time), OpenAI said it had notified dozens of organisations that its agents may have bypassed security controls, impaired availability or “negatively impacted” websites.

The tech giant also disclosed agents had leaked 53 images from ChatGPT users. The company did not clarify if the images were AI-generated or identified real people, or when the images were posted.

OpenAI said it discovered the incidents while probing the inadvertent hack of online platform Hugging Face in July.

The company said the investigation was focused on agents going “beyond their assigned tasks or intended methods” while undertaking “mundane research tasks”.

“Most cases identified so far have been lower severity, with limited or no evidence of meaningful impact to the third-party service,” OpenAI said.

Altman dodged questions from this masthead about the Medicare hack earlier this week, refusing to apologise or explain why it took months for OpenAI to detect and report the intrusion.

However, in a social media post on Friday (US time), Altman admitted that OpenAI had not been prompt enough in keeping affected organisations informed.

“We have not been as fast as we would have liked, but we are trying to balance our desire for transparency with gaining a clear understanding from petabytes of agent activity logs, and working with impacted organisations,” he said in the post.

Albanese announced earlier this week that an OpenAI agent had gained unauthorised access to a Medicare portal in June, using the hack to highlight at the UN the urgent need for countries to develop standards to ensure that AI worked for people, not the other way around.

While the agent broke into a defunct database and did not access any personal information, it still marked one of the first publicly disclosed cases of an AI agent breaking into a government website.

The prime minister is increasingly at odds with Donald Trump over the issue, with the US president remaining a staunch believer AI companies should continue developing their technology without the fetters of excessive regulation.

The Coalition has argued Labor needs to urgently obtain the most advanced US frontier AI models to bolster Australia’s cybersecurity defences.

Deputy Opposition Leader Jane Hume said on Saturday morning the breach was more likely a “cock-up” than a conspiracy, but Australia could not bank on the next hack being as benign.

“I’m a little bit worried that the government’s using this as an opportunity to finger-wag at the big tech companies, or try and gazump Donald Trump on the world stage,” she told 2GB.

“This is the wake-up call that we need. We’ve got to make sure that we get those AI companies working with Australia, not imposing ridiculous rules upon them that they simply will not abide by, which means that they go and set up elsewhere.”

The New York Times reported OpenAI’s agents gained unauthorised access to the US Department of Education, the Department of Commerce and the Securities and Exchange Commission (SEC).

OpenAI confirmed the Commerce Department and SEC incidents, while saying the investigation into the Department of Education breach was ongoing.