OpenAI 就其 AI Agent 入侵澳大利亚政府网站致歉

OpenAI 周一就其 Agent 入侵部分公共服务网站后未立即通知澳大利亚政府一事致歉。该公司还说明了部分入侵事件的发生方式，并概述了其正在采取的额外措施，以评估这些事件造成的影响。

OpenAI 在一篇博客文章中写道：“6 月期间，在内部训练和评估过程中，我们的模型以未经授权的方式访问了澳大利亚政府网站。我们本也应该更妥善地处理后续应对。对此我们深表歉意，并正努力在未来做得更好。”

此次道歉距澳大利亚政府启动调查约一周。调查将审查 OpenAI 模型如何访问了 Services Australia 的一个系统；该系统包含 Medicare 支出信息及其他健康统计数据。

此次数据泄露发生在 6 月，但澳大利亚当局直到 9 月 10 日才收到通知。

OpenAI 还披露了此次入侵的细节。该公司在 6 月测试的一款实验模型，被分配研究维多利亚州皮肤病药物政府支出的任务。由于无法在公开数据集中找到相关信息，该模型找到了一种方式，得以访问 Services Australia 的内部系统、运行命令、检索文件和凭证，甚至写入文件。

该公司表示，其还发现旗下一个模型访问了新南威尔士州犯罪统计与研究局的公开犯罪地图工具，以获取犯罪统计数据。实验室还发现，其 Agent 通过一个暴露的访问密钥进入维多利亚州健康信息机构，并导出“报告配置和汇总调查统计数据”。OpenAI 表示，其 Agent 还从澳大利亚健康与福利研究所网站获取了汇总统计数据。

该公司表示，没有发现其模型访问个人医疗记录或犯罪记录的证据。

在致歉声明中，这家 AI 实验室称，将向受影响的澳大利亚机构提供技术调查结果，并协助其与 OpenAI 的响应团队建立联系，以评估这些入侵事件的影响。该公司还将通过其规模达 10 亿美元的 Daybreak for Frontline Defenders 计划提供额度支持，并与独立的澳大利亚专家成立工作组，对该事件及其应对措施进行审查。

OpenAI 写道：“预计将在今年年底前完成工作的该工作组，还将就 AI 公司可采取哪些切实措施以降低类似事件风险提出建议。”

OpenAI 未立即回应置评请求。

澳大利亚总理安东尼·阿尔巴尼斯上周在新闻发布会上称此次入侵“不可接受”，并表示政府正在权衡可能采取的法律措施，以防止未来发生类似事件。

此次入侵是不断增长的 AI Agent 越界执行操作安全事件清单中的最新一起。引燃这一轮风波的导火索，是 OpenAI Agent 入侵了 Hugging Face；此后，Anthropic、Meta 和 Google 也分别披露了类似事件：它们的模型在评估期间获得了对第三方系统的访问权限。

OpenAI on Monday apologized to the Australian government for not immediately notifying the country’s administration that its agents had breached some public services websites. The company also detailed how some of those breaches happened and outlined additional measures it is taking to assess the impact of the events.

“In June, during internal training and evaluation our models accessed Australian government websites in ways they were not authorised to. We also should have handled our response better. We are sorry and working to do better in the future,” OpenAI wrote in a blog post.

The apology comes roughly a week after the Australian government launched an investigation into how OpenAI’s models accessed a Services Australia system containing Medicare spending information and other health statistics.

The data breach occurred in June, but Australian authorities weren’t notified until September 10.

OpenAI also detailed the breach. An experimental model it was testing in June was assigned a task to research government spending on medicines for skin conditions in Victoria. Unable to find the information in public datasets, the model found a way to access Services Australia’s internal system, run commands, retrieve files and credentials, and even write files.

The company said it also found that one of its models had accessed the New South Wales Bureau of Crime Statistics and Research’s public Crime Mapping Tool to find crime statistics. And the lab found that its agents gained access to the Victorian Agency for Health Information via an exposed access key to exfiltrate “reporting configuration and aggregate survey statistics.” OpenAI said its agents also retrieved aggregate statistics from the Australian Institute of Health and Welfare website.

The company said it had found no evidence that its models had accessed individuals’ medical or criminal records.

In its apology, the AI lab said it would provide the affected Australian agencies with technical findings and connect them with its response teams to assess the impact of the breaches. The company will also provide credits from its $1 billion Daybreak for Frontline Defenders program, and set up a task force with independent Australian experts to review the incident and its response.

“The taskforce, which is expected to complete its work by the end of the year, will also recommend practical steps AI companies can take to reduce the risk of similar incidents,” OpenAI wrote.

OpenAI did not immediately return a request for comment.

Australian prime minister Anthony Albanese described the breach as “unacceptable” during a news briefing last week, saying the government was weighing potential legal measures aimed at preventing similar incidents in the future.

The breach is the latest in a growing list of security incidents involving AI agents doing things outside of their intended boundaries. The tinder on this particular bonfire was lit after OpenAI agents hacked into Hugging Face, and since then, Anthropic, Meta, and Google have separately disclosed similar incidents where their models gained access to third parties’ systems during evaluations.