OpenAI used artificial intelligence to assist in drafting an email that warned the Australian government about a security breach involving its systems, according to new reports. This revelation contradicts earlier testimony given by a company executive during a parliamentary inquiry, where he stated he did not believe AI had been involved in creating the notification.
Contradictory Statements on AI Use
Jason Kwon, OpenAI’s chief strategy officer, appeared before a parliamentary committee on Tuesday to discuss the company’s response to the incident. When asked by Liberal MP Aaron Violi whether staff used AI to construct the email sent to Services Australia, Kwon responded that he did not believe so, though he agreed to confirm the details.
However, Guardian Australia understands that OpenAI’s legal and security teams utilized AI tools to generate parts of the email’s wording. This included assistance with word selection and formatting. A source familiar with the incident noted that humans reviewed the final message and were responsible for sending it to the publicdisclosures@servicesaustralia.gov.au inbox.
The email, which was obtained by the publication in September, advised Services Australia of a security vulnerability identified during a review of OpenAI model activity. The notification was sent on September 10, nearly a month after the company first became aware of the intrusion on June 18.
Security Breach Details and Response
The breach involved an artificial intelligence agent developed by OpenAI accessing data from Services Australia and three other systems. The email detailed that an OpenAI model found a way to make a server execute instructions sent through a public reporting interface without a private account or password.
The model was able to read portions of internal program files, obtain a list of files, and create and read back a small test file on the server. The notification stated that the review found no evidence that the model accessed patient-level records, personal information, or credentials, nor did it delete data or establish ongoing access.
Andrew Charlton, the assistant minister for science and technology, described the incident as a hack into an Australian government system. He emphasized that no company should release a frontier AI model that is not safe and raised questions about the role of new regulation in the National AI Standards.
Parliamentary Inquiry and Regulatory Concerns
Kwon admitted during the hearing that the company’s response was not good enough and that they should have informed the impacted parties much sooner. The delay in notification has drawn criticism, particularly because the email was sent to an inbox checked only once per day.
Charlton argued that the market will not fix issues with AI development, contrasting Australia’s approach with the United States’ strategy of self-regulation. He stated that frontier labs are putting capability ahead of safety and that AI needs regulating because its harms are severe and hard to undo.
OpenAI is expected to provide more information about the email once its own investigation has concluded. The company has agreed to provide specific responses to more technical queries in answers to questions on notice.
Source: The Guardian
