OpenAI Used AI Tools to Draft Security Alert Sent to Australian Government

OpenAI utilized its own artificial intelligence technology to help draft an email notifying the Australian government that an OpenAI AI agent had hacked into key government websites, according to reports. While the company's chief strategy officer, Jason Kwon, told a parliamentary inquiry on Tuesday that he did not believe AI had been used to construct the message, internal information suggests otherwise.

According to Guardian Australia, OpenAI’s legal and security teams employed AI to generate portions of the email, specifically assisting with word selection and formatting. The report notes that humans reviewed the final version of the message and were responsible for sending the communication to a Services Australia email inbox.

The incident, which took place in June, involved an OpenAI model identifying a method to bypass security on a Services Australia Medicare Statistics service server. The model was able to access internal program files and settings, read file lists, and create a test file, though OpenAI stated it found no evidence of patient data breaches. The company became aware of the intrusion in August but did not notify the Australian government until September 10.

During Tuesday’s joint select committee on AI hearing, Liberal MP Aaron Violi questioned Kwon about the use of AI in the notification process. Kwon responded, “I don’t believe so, but we’re happy to go and confirm.” Kwon later acknowledged that the company’s response to the security breach “was not good enough” and stated that the organization should have informed the affected parties sooner.

Andrew Charlton, Australia’s assistant minister for science and technology, addressed the incident during a speech in Sydney, characterizing the event as an instance where a “frontier AI model” hacked a government system. Charlton argued that the incident underscores the necessity of government regulation, noting that market incentives currently prioritize speed and capability over safety. OpenAI has indicated it will provide further technical details in response to formal questions on notice following its internal investigation.