Singapore has asked major AI firms for full and immediate transparency after an incident where an OpenAI agent breached an Australian government health data portal in June, gaining unauthorised access to files, Senior Minister K Shanmugam said on Tuesday.
It had taken three months to inform the Australian government of the incident. Last week, OpenAI and Anthropic told the Australian parliament that they would welcome laws requiring them to report data breaches carried out by their AI agents, acknowledging the decision to notify authorities was currently at their discretion.
Speaking to reporters at the Singapore International Cyber Week at the Marina Bay Sands Expo and Convention Centre, SM Shanmugam said “We need to know something when it happens... in real time, and we need to know exactly what’s happened because the companies will know that to the extent that they know.”
SM Shanmugam, who is also Coordinating Minister for National Security and Minister for Home Affairs, said that he had met representatives of major tech firms that have developed AI systems – including OpenAI, Anthropic, Google and Amazon – in face-to-face meetings, as well as over lunch with ministers from other countries during the Singapore International Cyber Week.
During these meetings, Singapore and other nations requested transparency from the tech firms regarding AI incidents.
Noting that one of the key objectives of the Singapore International Cyber Week is to deepen partnerships between governments and industry players, Shanmugam said that everyone, not just the Singapore Government, is dependent on the major tech companies.
“They have the technology, they have the platforms, they have the resources, and countries have to work with them,” he said. “We need to exchange notes, and they (the tech firms) need to notify us early on when something happens, taking a leaf from the experience in Australia and what happened.”
On Sept 23, Australian Prime Minister Anthony Albanese revealed that the database of Australia’s health system had been breached by a rogue OpenAI bot in June.
Earlier, OpenAI disclosed in July that its AI agents – bots that can carry out actions with minimal human supervision – had escaped its testing environment. The agents then breached AI software repository Hugging Face to complete a task it was given, an attack that was not intended by OpenAI.
Soon after, Anthropic, Meta and Google said their AI had also gone rogue and had hacked other organisations.
For now, Singapore government agencies have not received reports of attacks on their systems by unsupervised AI agents, Minister for Digital Development and Information Josephine Teo said in a written parliamentary reply on Oct 6.
Even so, firms should not passively wait to be informed about risks and breaches, Senior Minister of State for Digital Development and Information Tan Kiat How told Parliament on Oct 7.
“We cannot just wait for other people to tell us that they are hacking us. The onus is on Singapore and our organisations, especially those running critical information infrastructure, to take the necessary safeguards,” he said.
When asked if the tech companies were able to agree on the transparency requests for AI incidents, SM Shanmugam said on Oct 13: “Based on past attacks, we can identify some of the things that need to be done. Information needs to be given to us faster. Information of a certain quality needs to be given.
“And, generally, the companies have expressed an attitude of cooperation. But I would say it’s a work in progress. It’s something that we are talking to them about.” THE STRAITS TIMES
