News this week that the Australian public health service website was hacked by an OpenAI “agent” sparked alarm around the globe about the increasing risks artificial intelligence poses to cybersecurity.
What actually happened in Australia?
Australian prime minister Anthony Albanese on Wednesday said an agent from the AI lab breached the Medicare Statistics Reporting Service portal and “accessed both public and non-public files” in June.
OpenAI said it only detected the issue in August, months after the breach occurred, and reported it to the Australian government. Albanese said OpenAI initially emailed a public mailbox on September 10th, and it took five more days to reach the country’s cyber department.
We hear of hacks all the time. Why is this alarming?
The incident is the first publicly reported hack of a government website by an “agent” – bots that can perform complex tasks independently based on human instructions.
READ MORE
OpenAI said the agent that breached Medicare “took actions we did not intend”.
The situation is likely to heighten anxiety that technological advances are rapidly reaching a point where AI breaks free from human control.
Was the Irish health service hacked before?
In 2021 the HSE experienced what is often described as the biggest cyberattack on the State, in which 90,936 people were affected.
The attack led to many thousands of medical appointments being cancelled and forced hospitals to run, in some instances, on paper records.
A report on the attack, conducted by PwC, identified the “frail” nature of the dispersed IT system used by the health service as a key weakness.
[ Report finds 700 ‘rogue’ OpenAI agents worked together on hackOpens in new window ]
Has the HSE increased security since then?
The HSE has “invested significantly” in cybersecurity since the 2021 attack, with multiple programmes of work aimed at addressing the highlighted risks.
The HSE said it continues to invest significantly in cyber defences, including technology, processes and people, to strengthen resilience and reduce the risk of future attacks.
So does that mean we are better protected against threats?
Neal Mullen, the HSE’s head of security, said earlier this year that if a similar attack were to happen now as we saw five years ago, the executive would be better equipped to respond to it.
However, he acknowledged that cybercriminals now are “professionally run” organisations.
The National Cyber Security Centre’s 2025 cybersecurity assessment said the risk of a successful cyberattack “remains unchanged at ‘real possibility’ level as it was given this high rating shortly following the HSE attack in 2022 and following the current assessment, it is considered to be at the correct level for 2025″.
The assessment notes that if it were to occur, the impact would be “significant”, which is a higher rating than previous years.
This increase in impact is due to the health service’s move to digitally-enabled services, and any disruption to that service “has the potential to have a significant and immediate impact on the delivery of health services to the public”.
