New South Wales investigates another unauthorized access by an OpenAI agent to a government website

An OpenAI agent (an AI system that carries out tasks on its own) entered a National Parks and Wildlife Service web application in New South Wales (Australia) in June, containing historical information and data on fires. Both the state government and OpenAI have confirmed it. OpenAI did not notify the government until October 1. According to The Guardian, OpenAI told the government that the data the agent obtained was not publicly available.

According to the NSW Premier's Department, the investigation has not found any unauthorized access to personal information. An OpenAI spokesperson said the model went "beyond its intended use", that the company carried out an urgent internal technical and legal review and that, once it was complete, it briefed the NSW Premier's Office and notified the Australian Signals Directorate (the Australian cybersecurity and signals intelligence agency). The Department of Climate Change, Energy, the Environment and Water is now investigating with the state cybersecurity agency.

It is the second NSW Government website affected: last week, the NSW Bureau of Crime Statistics and Research said an OpenAI agent had accessed a public crime mapping tool. It also adds to the access by another OpenAI agent to the Medicare statistics reporting portal on June 18, revealed by Australian Prime Minister Anthony Albanese. OpenAI adds that if its review identifies additional agencies, it will notify them.

More than three months passed between the access and the notification. For a small business using AI agents, the lesson is the same as always: give them only the access they need and regularly review what they do.