The Albanese Labor Government must explain how an AI agent gained unauthorised access to a Services Australia system and why the Government did not detect it.
Australians only know this breach occurred because OpenAI told us about it.
This incident raises serious questions about the adequacy of Services Australia’s cyber defences, particularly given the Auditor-General has previously raised concerns about its cyber security.
The incident should be a warning about the new cyber risks posed by rapidly advancing artificial intelligence.
The Government needs to explain what it is doing to ensure Australia has the capability to detect and defend against AI-enabled attacks before an external company has to tell it that a breach has occurred.
It must also explain why seven days passed between the Minister being advised of the incident and Australians being told.
Services Australia was notified of the incident on 10 September. Minister for Government Services Katy Gallagher was advised around 17 September, yet Australians were not told until 24 September.
The Government says it needed time to understand the incident and receive further technical information, but that does not explain why Australians could not have been told earlier while those investigations continued.
Leader of the Opposition Angus Taylor said Australians deserved transparency when government systems were breached.
“Seven days passed between a Minister being told about this incident and Australians being told about it. The government needs to explain why,” Mr Taylor said.
“This incident is a serious warning about the security of our government systems in the age of AI. These systems hold an enormous amount of personal information, so the government must explain what steps it has taken to keep those systems safe from this new form of attack.
“To address a problem, you must first acknowledge there is an issue. The Prime Minister gave a keynote address just a few months ago on AI and didn’t mention cyber defense.
“The Prime Minister needs to act urgently. We need leading frontier companies to make sure we are identifying vulnerabilities in our critical systems as early as possible, to protect all Australians and our way of life.”
Deputy Leader of the Opposition, Senator Jane Hume, said the incident raised serious questions about the cyber security of government systems.
“Labor has questions to answer about why Services Australia’s cyber defences were not good enough, despite concerns raised by the Auditor-General two years ago,” Senator Hume said.
“The only reason we know about this incident is because the Government was told. They have no idea if this has happened before, and no idea how to stop it happening again.
“Labor have no plan for this emerging threat. While they want to censor Australians online, they haven’t even thought about basic online protections for Australians’ data.
“Why did it take seven days for Services Australia to inform the Minister that their system had been breached.
“Then, once the Minister knew, another seven days passed before Australians were told.
“The government says this was serious enough for the Prime Minister to raise directly with the head of OpenAI. If it was serious enough for that, Australians deserve a proper explanation for why they were kept in the dark for a week.
“You can investigate an incident and inform the public at the same time. Australians should not have to wait a week to find out that a government system has been accessed without authorisation.”
Shadow Minister for Home Affairs, Jonathon Duniam, said the incident raised broader questions about the security of government systems.
“This is a serious incident where an AI agent has got to where it was not authorised to go and accessed non-public government files,” Senator Duniam said.
“The question that the government must answer for all Australians is: what actions have been taken to bolster the cyber security of all government departments to protect the data of Australians?”
Shadow Minister for the Digital Economy and Cyber Security, Aaron Violi, said the core role of government is to keep Australians safe.
“AI brings new and bold opportunities for our nation, but it also increases the sophistication and scale of cyber threats and presents a cyber challenge we have never seen before,” Mr Violi said.
“But just like AI can be used against us, we can choose to harness AI to strengthen our cyber defences and national security to protect our way of life. We need to significantly scale up our cyber security, and the best tools to do that are AI tools.”