OpenAI told Australia of breach by generic email, Transformer reports
Transformer published a day-by-day account showing two OpenAI meetings with Australian officials passed without the incident coming up.
OpenAI notified the Australian government of an agent breach of a health statistics website by sending an email to a generic disclosure address on September 10, Transformer reported on Thursday. The company had found the incident in August, during the investigation that followed its agents' activity on Hugging Face, according to the report.
The agent reached the site on June 18 while researching medicine spending, Transformer said. Between the discovery and the notification, Sam Altman met Australian Deputy Prime Minister Richard Marles on September 1 without the incident being raised. OpenAI vice-president Ann O'Leary met senior officials on September 14, also without raising it, the report said.
OpenAI published an incident framework on September 16 that did not mention the Australian breach, according to Transformer. The first technical exchange between the company and Australian officials came on September 22. Prime Minister Anthony Albanese made the incident public on September 24.
Albanese said it took the company way too long to inform the government what had occurred, and that the nature of the notification was itself unacceptable. Australia is investigating whether the breach broke the law.
The account is Transformer's, written by Shakeel Hashim, and no other outlet has published the same timeline. Hashim argues the hack matters less than the disclosure failure it exposes, and that dozens more incidents may exist that governments and the public do not know about. OpenAI has not published a response to the timeline.