OpenAI’s Medicare hack is a bleak opportunity for Australia to address its security shortcomings post-haste | Van Badham

Whoopsie! Dr Sam Altman Frankenstein regrets to inform you he’s lost control of his OpenAI monster.

It’s roving around doing things that provoke international legal investigation, and Australia has found out in the worst possible way.

The prime minister, Anthony Albanese, was obliged to announce from the United Nations summit on Thursday morning Australian time that an agentic AI from the OpenAI stable had gained unauthorised access to both public and non-public information from Australia’s Medicare website.

The good news in this debacle is that so far it appears no personal information held in Medicare’s records was compromised. Pursuing “a benign task” of compiling some health statistics, the portal breach accessed non-sensitive data about spending.

The good news, alas, ends here. OpenAI – a company worth US$852bn as per its last valuation – informed the government of the breach by … sending an email to its public email account three months after the hack occurred. Albanese revealed the date of Services Australia’s worst ever Inbox Zero was 10 September, and the Australian Cyber Security Centre was informed on 15 September.

Albanese at the UN has proved a fairly nimble diplomat, much to the surprise of anyone who has been on the receiving end of his vengeance at home. One imagines that a desire to soften fierce Trumpian pushback to Labor’s attempts at “digital duty-of-care” regulations for – ha! – AI and social media inspired the PM’s epically cringeworthy grip-and-grin selfie with the unpopular president. It was “photo diplomacy” wisely followed by a well-publicised hug with Volodymyr Zelenskyy.

After a direct meeting with Altman, the PM described the “obviously unacceptable” incident and his government’s “extreme concern”. Announcing immediate taskforces and urgent reviews into the breach and its national security implications, Albanese said Altman was aware “the company had not done good enough”.

“Aware” may actually be underselling it, because Altman has been making speeches of his own at the UN – to no less than the UN security council, alongside his supposed corporate rival, Anthropic’s CEO Dario Amodei – urging the governments of the world to collectively enforce regulations of the technology guided by democratic institutions.

Begging the question: Dr Frankenstein, what the hell’s been going on in your lab?

One longs for the tender innocence of last week when we could describe warnings from ex-Anthropic employees that AI could destroy the world within 10 years as merely utterly terrifying – because the attitude of the security council member representing the world’s richest democracy is that the “only control or ‘guardrails’ that AI needs is a STRONG AND SMART (High IQ!) PRESIDENT”.

Here’s hoping one will turn up. In the unregulated, commercial AI environment where “crawler” AIs are autonomously finding their way around sovereign data protection systems to scrape information, the explanatory metaphor that leaps to mind is if nuclear weapons had been retailed and the world only found out about radioactive fallout once a 10-year-old playing with it in a back yard had permanently depopulated Baltimore.

Is American laissez-faire fuckwittery to blame here? Yes – and Australians are right to be screaming that if OpenAI were a Chinese or Iranian company hacking into our systems ambassadors would be marching out of embassies with grand announcements and thundering speeches of condemnation.

But they’d also be wise to remember that geographically isolated, distant middle power Australia has only been afforded grandiosity on the world stage because in the post-second world war, pre-Trump era, it had the umbrella protection of a meaningful alliance with Daddy America.

And these days it’s Daddy America who’s a rules-free maniac whose sole political calculation is that money equals power and a literal “to the victor the spoils” foreign policy. To imagine Donald Trump’s US state department will be inspired into acts of responsibility due to Australian shaming it for data theft is some high genre alternate history. The man Trump pardoned who ran a stolen-data criminal marketplace spoke at the Republican convention in Dallas this year. Symbolic, no?

Internationally, the realignment of powers in the wake of Trump’s thuggery advances, but what role Australia will be offered in that realignment is uncertain, and it is narcissistic to pretend otherwise.

Locally, we’re not powerless. The Medicare breach is a bleak opportunity to address our revealed information security shortcomings post-haste, with full democratic transparency and accountability. All Australians should demand independent means to protect ourselves from the new front in the information war. If Albanese’s new taskforce determines that ministerial oversight failed to protect Medicare or any other comprised dataset, heads must – publicly – roll.

The ACTU has long been warning of US abrogation of AI security obligations, demanding the development of “sovereign AI” capacity to meet oncoming threats. Every one of us should back calls to regulate the living bejeezus out of all AI-capable foreign platforms seeking to operate here – or impose moratoriums on operations outright.