OpenAI Government Breach-Warning for National Security
In case any government thought that their systems were either off limits to AI hacks or ultimately secure, they got disabused of that this week when the Australian government admitted what happened.
By the way, I don’t think AI thinks that government systems are off limits and many people would agree that they are not always secure.
The breach of the Australian Medicare system was in June, but they did not admit the breach until now.
The agent accessed a statistics portal of Australia’s publicly funded universal healthcare system.
OpenAI learned of the incident last month and then contacted the government via a general email inbox – which is, of course, not exactly the best way to tell a government agency “sorry, we hacked you”.
In this particular case, we think the agent did not have malicious intent. But just because there was no malicious intent does not mean that the agent could not do any damage.
An agent, doing what it thinks it is supposed to do, could take a system down or corrupt the data or any number of other things. A specific case in point was an internal agent that an Amazon global admin asked to perform a task. The agent decided it needed to access Amazon’s production environment in China. It then decided it needed to rebuild that environment and since it was running under the employee’s identity (Amazon should know better, did not have rules against that at the time and does now), it was able to access a code repository, found the right API key and deleted that production environment. Burned to the ground. Not malicious, but definitely harmful. It took Amazon nine hours to recover.
If, on the other hand, we are talking about a rogue AI or a malicious AI, and the company did not have the resources of Amazon (they did not publish how they recovered, but I bet it was an “all hands on deck” situation), the damage could have been far worse. As it was, Amazon lost out on millions of orders during the downtime.
The Australian Prime Minister is proposing to develop an agentic defense force, owned and managed by Australia and developed through a public-private partnership. The government would need to test such a system and it would need to be continuously monitored and updated. And funded forever – not a simple or cheap solution.
While the Medicare system is sensitive, it is not operationally critical. If the agent compromises the water supply (and we know that they are vulnerable based on the 100 plus systems that were attacked in the last month or two), wastewater treatment (causing untreated water to be discharged into public waterways – which we just saw near Pueblo, CO, although in that case not due to a hack, but it still did a lot of damage), the power grid or gas systems, just as some examples, that could be a way bigger problem. Depending on what the agent does and its intent, it could take a long time to recover.
This problem is not limited Australia. In fact no country, province, state or local government is exempt. It is also likely that none of them are prepared. If you need assistance, please contact us.
Credit: Cybernews
by 