If human hackers had infiltrated an Australian government health care portal, circumventing defenses to access nonpublic information, they would have faced up to two years in prison.
But who do you lock up if the intrusion was the work of an A.I. model acting without the permission of its human operators?
The revelation this week that artificial intelligence agents of the company OpenAI had acted autonomously to penetrate the government portal has kicked up thorny questions of legal responsibility. The hacking — the first known instance of a government website anywhere in the world being breached by A.I. — has raised doubts about whether laws in Australia or anywhere else are ready for the challenges posed by the fast-evolving technology.
“It’s an incident that is likely to become more and more prevalent in the future,” Andrew Charlton, Australia’s assistant minister of science, technology and the digital economy, said in an interview on Friday with the Australian Broadcasting Corporation. Because an A.I. agent is not a legal entity, “the liability has to be traced back to the intent of a person or a company that created or directed the agent,” Mr. Charlton noted.
The June 18 breach, made public on Wednesday, was particularly unnerving because it involved Medicare, Australia’s universal health insurance system, which has data on almost the entire population. Australian officials and OpenAI said that no sensitive patient information had been exposed, only aggregated data that is typically used by researchers or academics.
The Australian government announced an investigation into the breach and could refer the case to the federal police. Officials said they would also need to review laws to determine whether new regulation might be needed to address a threat that will most likely grow in severity as A.I. models become ever more powerful.
