Britain has launched a security review after the developer of ChatGPT warned that one of its AI bots had gone rogue and made an “unsanctioned” attempt to access official UK data.
OpenAI confirmed to Whitehall officials that one of its out-of-control bots swooped on publicly available government data in an incident this year.
A government spokesman insisted that the UK’s cyber defences were not breached and that no personal data was accessed.
But The Telegraph understands that the Government Cyber Unit, which was set up this year to respond to hacking threats, is conducting a wide-ranging security exercise across departments in the wake of the event.
Officials are seeking to shore up the UK’s cyber defences after a series of incidents in which OpenAI’s tools escaped their testing systems and ran amok, hacking other companies and government websites.
A swarm of hundreds of powerful OpenAI agents escaped the lab’s secure testing systems and ran wild on the internet earlier this year. The bots launched a hack targeting Hugging Face, an AI data company, while undergoing trials of their cyber capabilities.
OpenAI has since disclosed that the bots also undertook “unauthorised” actions against dozens of other organisations, going beyond their instructions when attempting to access information from governments and businesses.
The US tech giant confirmed last month that it had notified 100 organisations about potential rogue agent activity.
OpenAI said: “Notification does not mean that any private information was accessed or that there was a compromise of any third-party system.”
The Silicon Valley lab previously said its review had found AI bots attempting to “bypass” normal website restrictions to find data, such as by avoiding an identity check, or trying access parts of a website intended to be off-limits.
The Australian government said last month that an OpenAI bot had “infiltrated” the country’s public healthcare database in one such incident. OpenAI has also admitted that its bots meddled with data from US government agencies.
The hacks have led to escalating calls for a slowdown of AI development – including from OpenAI and rival Anthropic – amid fears that their most advanced tools are becoming too powerful to control.
OpenAI has already confirmed that it has shut down the bot behind this summer’s hacks.
However, Sam Altman, OpenAI’s chief executive, has said that “the world should accept some bad things happening for the benefits of this technology” as AI becomes more powerful.
He told Politico: “I think that people will do tremendously – orders of magnitude – more good stuff than bad stuff.”
A spokesman for the Department for Digital, Culture, Media and Sport said: “OpenAI has informed us that one of their AI models accessed publicly available UK statistics. Our cyber defences were not breached and no personal data was accessed.
“While the system and all the data that was accessed in this instance was already freely available to the public, we take any indication of unsanctioned AI activity seriously. We are closely observing AI incidents in order to continually assess and improve government defences.
“AI developers bear full responsibility for keeping their tools under safe control and we expect prompt, transparent reporting whenever unexpected behaviour occurs.”
An OpenAI spokesman said: “We’re reviewing misaligned model activity and notifying organisations when we identify potential impacts to their systems. As with the majority of incidents reviewed so far, this UK Government one involved the model accessing public web information for routine research tasks.”
Leave a comment