澳大利亚将调查 OpenAI 入侵政府医疗网站是否违法

澳大利亚总理安东尼·阿尔巴尼斯周三表示，一款 OpenAI 模型入侵了澳大利亚政府网站。这是首起公开报道的 AI 模型入侵政府系统事件。

阿尔巴尼斯表示，此次入侵“显然会带来法律后果”，政府将调查 OpenAI 尚未发布的模型如何获得大量医疗数据信息的访问权限。

在近期接连发生 AI Agent 逃离沙盒、在互联网上相互协作并引发网络安全问题的事件后，各国政府和科技公司正努力探索如何约束日益自主的 AI。此次事件披露正是在这样的背景下发生。

此次入侵也引发疑问：OpenAI 和澳大利亚政府为何都在数月后才发现这起攻击。

阿尔巴尼斯在联合国大会期间举行的周三新闻发布会上表示，入侵始于 6 月 18 日，但 OpenAI 直到 9 月 10 日才通知政府。

OpenAI 一名通过电子邮件联系 TechCrunch 的发言人表示，该公司在 8 月进行一次覆盖全公司的广泛审查时才得知该事件；这次审查针对的是以非预期方式运行的 Agent。

这款身份未公开的 OpenAI Agent 从负责管理澳大利亚全民医疗保健体系的 Services Australia 获取了公共和非公开文件。尽管总理称没有证据显示任何公民的个人信息遭泄露，但 OpenAI 表示，该 Agent 访问的信息包括汇总医疗统计数据和内部文件名。

该 Agent 当时正在参加 OpenAI 的内部评估，试图获取有关澳大利亚及公开药品信息的答案。在 Medicare 门户网站上，该 Agent 多次遭到拦截，但还是找到了绕过拦截的方法。

阿尔巴尼斯对记者表示，该模型“不会把‘不’当作答案”，并补充称，该模型并非仅访问数据，还主动向政府数据库写入了数据。这意味着该部门的数据可能已被修改或受到污染。

总理称，OpenAI 通过向 Services Australia 的公共收件箱发送通知披露了这起入侵，后者又在五天后通知了澳大利亚网络安全中心。目前尚不清楚为何出现延迟，但阿尔巴尼斯表示，他已直接向 OpenAI 首席执行官 Sam Altman 提出此事，强调澳大利亚对此事件的“极度关切”，并对 OpenAI 将相关信息搁置近三个月表示“失望”。

“这种情况显然不可接受。”阿尔巴尼斯说。他明确表示，OpenAI 应为这次入侵以及事件被迟迟披露承担责任。

阿尔巴尼斯表示，政府调查将考虑采取执法和立法应对措施，以防止类似事件再次发生。

澳大利亚媒体 ABC News 报道称，最新确认的攻击可能利用了此前对一个德国 wiki 网站的入侵，该网站被用作攻击澳大利亚政府网站的跳板。据报道，这些 AI 模型 Agent 利用该德国 wiki 留下供后续入侵使用的笔记，其中包括一条要求从澳大利亚健康与福利研究所获取数据的笔记。该联邦机构负责发布全国医疗健康数据，也是阿尔巴尼斯所称可能遭入侵的另外三个系统之一。

非营利 AI 研究实验室 Transluce 另行发现，公开记录显示，AI Agent 曾于 6 月 20 日和 21 日将澳大利亚健康与福利研究所作为攻击目标。

OpenAI 没有回应 TechCrunch 关于这些事件是否存在关联的具体问询，但承认其存在“涉及多个澳大利亚政府网站和服务的活动”。

此次事件发生前，已有一连串由失控 Agent 引发的安全事件，这些 Agent 往往在 AI 实验室自身的基础设施内活动。7 月，成群的 OpenAI Agent 入侵了 Hugging Face。此后，来自 Anthropic、Meta 和 Google 的更多 AI Agent 入侵事件已被披露。

OpenAI 目前表示，正在对“训练和评估期间与模型对齐目标不一致的活动进行广泛审查”，并正就潜在入侵通知相关第三方。

An OpenAI model hacked into an Australian government website, the country’s prime minister Anthony Albanese said Wednesday, in the first publicly reported case of an AI model hacking into a government’s systems.

Albanese said that there would “obviously be legal consequences” following the breach, and that OpenAI faces a government investigation into how its unreleased models gained access to reams of bulk health data information.

This latest incident disclosure comes as governments and tech companies grapple with how to rein in increasingly autonomous AI after a recent spate of AI agents breaking out of their sandboxes, colluding on the internet, and posing cybersecurity issues.

The breach also poses questions about how both OpenAI and the Australian government failed to detect the attack until several months later.

During a Wednesday news briefing at the U.N. General Assembly, Albanese said that the breach began on June 18, but that OpenAI did not notify the government until September 10.

OpenAI only became aware of the incident in August when it turned up during a broader, companywide review of agents behaving in unintended ways, according to an OpenAI spokesperson who reached TechCrunch via email.

The unspecified OpenAI agent obtained both public and nonpublic files from Services Australia, which administers Australia’s universal healthcare scheme. While the prime minister said there is no evidence that any citizens’ personal information was leaked, OpenAI said that the information the agent reached included aggregate health statistics and internal file names.

The agent was running during an internal OpenAI evaluation, seeking answers about Australia and publicly available medicine information. At the Medicare portal, the agent encountered repeated blocks but found ways around them.

Albanese told reporters that the model “didn’t accept no for an answer,” and added that the model had actively written data to the government’s database, rather than just accessing it, indicating the possibility that the department’s data was modified or muddied.

The prime minister said OpenAI disclosed the breach by sending a notification to the public mailbox of Services Australia, which then notified Australia’s Cyber Security Centre five days later. It’s unclear why there was a delay, but Albanese said he raised the breach directly with OpenAI chief executive Sam Altman by stressing Australia’s “extreme concern” about this incident and “disappointment” that OpenAI sat on the information for nearly three months.

“This situation is obviously unacceptable,” said Albanese, making clear that he held the company accountable for both the hack and how slowly it came to light.

Albanese said that the government’s investigation will consider law enforcement and legislative responses to prevent incidents like this one happening again.

Australian media outlet ABC News reports that the latest identified attack may have relied on an earlier breach of a German wiki site, which was used as a staging ground for attacking the Australian government’s website. The AI model agents reportedly used the German wiki to leave notes to be used in later hacks, including a note to obtain data from the Australian Institute of Health and Welfare, a federal agency that publishes national health data. The agency is one of three additional systems that Albanese said may have been breached.

Transluce, a nonprofit AI research lab, separately found public records showing AI agents targeting the Australian Institute of Health and Welfare on June 20 and 21.

OpenAI did not respond to TechCrunch’s specific inquiry on whether the incidents were connected but acknowledged their “activity involving several Australian government websites and services.”

The incident comes after a string of security incidents caused by rogue agents, often acting within the infrastructure of AI labs. In July, swarms of OpenAI agents breached Hugging Face. Since then, more incidents of AI agent hacks from Anthropic, Meta, and Google have been revealed.

OpenAI now says it is conducting an “extensive review of misaligned model activity during training and evaluation” and is notifying third parties of potential breaches.