OpenAI agents targeted public data providers in multiple countries, probing some for vulnerabilities and exploiting a security weakness in an Australian government portal while performing information-retrieval tasks as part of a research project.
Earlier today, Australian Prime Minister Anthony Albanese confirmed that the agents breached a Medicare statistics reporting portal operated by Services Australia, the government agency responsible for delivering health and social payments.
The unauthorized access occurred on June 18 and allowed OpenAI agents to access public and non-public data.
Nonprofit research lab Transluce released a report on the activity based on analysis of public records from the URL scanning service urlquery.net. The findings showed that the AI agents used the service's remote browser system to retrieve data when direct access failed.
The lab describes three cases that occurred between May and June that impacted the Australian Institute of Health and Welfare, Data USA , and the digital library of the University of New Mexico.
According to the report, the AI agents performed seven probes against the educational organization, including attempts to exploit SQL injection, command injection, and path traversal flaws, while trying to retrieve a photograph.