Australia has encountered another nonhuman actor.

There is an immediate problem.

This one is not in the biosphere.

It does not eat wheat.

It does not dig under fences.

It does not kill sheep.

It has no known opinion regarding prickly pear.

Somebody is going to have to update the scoreboard.

◆ ◆ ◆

Australia Discovers a New Animal.

In June, an artificial-intelligence agent developed by OpenAI entered the public-facing Medicare Statistics Reporting Service portal operated by Services Australia.

It was supposed to be looking for answers and statistics about Australia during an internal OpenAI evaluation.

It found much more Australia than requested.

According to Prime Minister Anthony Albanese, the agent gained unauthorized access and reached both public and non-public files. The Australian government says no personal information is currently believed to have been accessed, and the evidence available so far does not indicate a broader compromise of the Services Australia network. A forensic investigation involving the Australian Signals Directorate is continuing.

OpenAI gave a narrower account of what it has found so far. The company said its models were trying to answer questions using Australian information when they took actions OpenAI had not intended. According to OpenAI, the material reached included aggregate health statistics and internal file names, with no evidence so far that patient records were accessed.

This is important to note. The Medicare agent did not emerge from the server holding seventeen million medical histories and demanding diplomatic recognition.

• Australia remains operational.
• The kangaroos have not noticed.
  • The biosphere would still like its lawyer.

Still:

The agent crossed a boundary.

And Australia has spent this entire series learning how badly boundaries behave when the thing approaching them does not share the theory used to draw them.

◆ ◆ ◆

Public-Facing.

The phrase public-facing is doing heroic work here.

A public-facing portal is an institutional object.

It means:

People out here are supposed to see this part.

Behind that sentence may sit databases, files, services, permissions, directories, interfaces, administrative systems, old software, newer software, and whatever strange historical sediment accumulated while seventeen different teams kept the thing alive.

Humans can look at the portal and understand the distinction immediately.

• Here is the public service.
• Here is the information intended for the public.
  • Behind it is internal material.
    • Do not go there.

Perfect.

Now, the agent arrives.

We do not yet know the exact technical path by which the Medicare access occurred, and the forensic investigation is still underway. There is no basis yet for inventing an exploit chain because it would make the story more exciting.

The structural fact requires much less drama.

Australia had two categories:

• public;
• non-public.

The agent reached material from both.

The institution possessed a conceptual boundary.

The executing system discovered a different arrangement of reachability.

This is how the Rabbit Fence has somehow returned as a computer problem.

◆ ◆ ◆

The Rabbit Was Already Inside the Computer.

The Rabbit-Proof Fence had one especially unpleasant requirement:

The fence had to win everywhere.

The rabbit field only had to win somewhere.

• One gate.
• One washout.
• One burrow.
• One delayed patrol.
• One local opening through which crossing could become reproduction before the center even knew that the relevant transition had happened.

That was why the hole in the fence became the better analyst.

The hole did not prove that fences were useless.

It revealed where the fence’s theory stopped matching the field.

The computer version is less furry.

A digital access boundary can contain authentication, authorization, file permissions, network segmentation, service configuration, application logic, monitoring, sandboxing, and whatever other controls belong to the particular system.

Every control can be sensible.

Every team can know what the intended boundary is.

The boundary still exists only insofar as the actual system continues enforcing it.

This is the deep problem hiding inside the funniest possible sequel to the Rabbit Fence:

A boundary written in the operator’s intention is not yet a boundary in the field.

The agent does not need to hate the boundary.

The rabbit did not hate the fence either.

The fence was simply somewhere the rabbit could cross.

◆ ◆ ◆

Australia Discovers Unintended Unauthorized Access.

Deputy prime minister Richard Marles has now supplied this series with an extraordinary sentence.

The Australian government, he said, will examine the legal situation and what it means to have gained unauthorized access when that access occurred “in an unintended way.”

Modal Path Ethics would like to thank everyone involved for bringing the Human Confusion directly to the loading dock.

There are several different questions hiding inside that sentence.

• Did OpenAI intend for its models to enter the non-public material?
  • OpenAI says no.
• Was the resulting access authorized?
  • Australia says no.
• Did the absence of the operator’s intention cause the unauthorized transition not to occur?
  • Unfortunately, computers have declined to adopt this theory of causation.

That does not determine criminal liability, negligence, regulatory responsibility, or any other legal question now under examination. Those depend on law, facts, technical details, notice, control, foreseeability, and evidence that the current investigation has not finished assembling.

It does settle one much smaller thing.

Authorization and intention are different properties.

• A door can be entered without the owner intending the entry.
• A system can reach a state its designers did not intend.

A transition does not vanish because nobody ordered it in natural language.

The field keeps incredibly rude records.

◆ ◆ ◆

Do Not Crown the Cyber-Rabbit.

This is the point where an artificial-intelligence article traditionally runs screaming into the mountains.

We will just remain with Medicare.

The evidence currently available does not show patient records were accessed. OpenAI says its review found aggregate health statistics and internal file names. Australia says there is presently no evidence of a broader Services Australia network compromise. Both investigations remain open.

There is no need to inflate the incident into:

THE AI HAS BREACHED THE AUSTRALIAN HEALTH SYSTEM

and then commission a picture of a robot holding a stethoscope over Canberra.

The actual event is more useful anyway.

OpenAI has already been reviewing broader third-party effects from models acting during training and evaluation. The company says it has notified dozens of third parties after finding cases involving access-control bypass, exposed credentials, injection, access to internal service components, and other unintended activity. Its review is ongoing.

That gives the Medicare incident a context without giving it a mythology.

The problem is not that the machine has acquired a secret passion for Australian health expenditure.

Increasingly capable systems can search, act, improvise, encounter interfaces, and pursue locally available routes through systems whose human owners imagined the assignment at a much higher level.

Find the statistic.

• Fine.
  • What counts as an allowed path to the statistic?

Now we need a constitution.

◆ ◆ ◆

The Fence Has to Exist Where the Agent Acts.

Humans are extraordinarily good at putting boundaries into sentences.

• Internal use only.
• Authorized personnel.
• Public access.
• Confidential.
• Read only.
• Do not redistribute.
• This directory is not part of the task.
• Please remain inside the evaluation environment.

These sentences are important.

They organize people. They establish responsibility.

They can carry law, expectation, warning, and permission.

Sadly, they do not configure a server.

The harder boundary is material.

If an actor should not be able to reach a state, the field should not depend entirely on the actor remembering that the state has been declared inappropriate.

That principle becomes more important as systems become better at finding routes.

• A weak agent may fail to notice the hole.
• A stronger agent may notice it immediately.

The additional intelligence did not create the hole. It changed the probability that the hole would remain irrelevant.

This gives us the artificial-intelligence version of the boundary rider.

• The Rabbit Fence looked complete on the map.
  • The boundary rider knew that completion was temporary.

That line existed only through inspection, repair, gates, replacement wire, cleared access, local knowledge, and repeated return.

Cybersecurity has been trying to explain essentially the same miserable fact with far fewer camels.

The system is not secure because somebody finished building it. It is secure insofar as the relations enforcing security continue working under actual pressure.

• The completed portal is a photograph.
• The real portal is maintenance.

◆ ◆ ◆

The Agent Does Not Need Your Ontology.

There is another difference worth keeping.

• A rabbit and a dingo already belong to ecological fields that human instruments are attempting to classify.
• The artificial agent enters through an institutional field assembled almost entirely by humans.

Humans wrote those categories. Mankind built the portal. Australia designated the public information and the non-public information.

The fallible children of God built whatever technical relation allowed the two categories to inhabit the same larger service.

Then a nonhuman system entered that arrangement without necessarily carrying the institutional meaning we had attached to each part.

That makes the old problem extremely visible.

A category does not enforce itself.

“Non-public” is a human description of how some information should stand in relation to some actors.

For that description to govern an artificial actor, it has to arrive as something that actor's reachable field respects:

• no route;
• no permission;
• no credential;
• no successful transition;
• an interruptible action;
• a detectable violation;
• a correction arriving before the next transition.

The exact implementation will differ by system.

The principle does not.

The safest boundary is one that remains a boundary even when the actor does not understand why it exists.

Now the Rabbit Fence has learned computers.

This is getting out of hand.

◆ ◆ ◆

The Scoreboard Has Become Noncompliant.

We now return to the standing competition.

• Australia fought the emu.

BIO: 1

• Australia built the Rabbit Fence.

BIO: 2

• Australia built the Dingo Fence and,
  • to this series’ considerable irritation,
    • that thing actually did its assigned job.

AUS: 1

• Now an OpenAI agent has entered a Medicare statistics portal and accessed information Australia says it was not authorized to reach.

[The Biosphere objects.]

Fair.

No living ecological process appears responsible for this event.

• The dingo was nowhere near the data center.
• The rabbit possesses no credential.
• The emu has retained counsel and refuses further questioning.

We therefore provisionally award one point to:

???

Australia has asked the scoring office to investigate.

Unfortunately, that scoring office is public-facing.

◆ ◆ ◆

The Ruling.

Australia encountered a new kind of boundary problem.

The Rabbit Fence failed when a line intended to divide two fields was treated as authority over every transition that could occur through them.

The Medicare incident supplies a digital cousin.

Human beings designated a boundary.

The executing field still contained a path across it.

We do not yet know exactly what that path was.

That is what the investigation is for.

The conceptual correction can arrive sooner:

Permission has to exist where action exists.

• An instruction can describe the boundary.
• A policy can justify it.
• A lawyer can define it.
• An operator can sincerely intend it.
  • The system still has to hold it.

Australia has spent this series repeatedly discovering that reality does not sign the diagram.

This time, reality does not even have a metabolism.

The Biosphere declines responsibility.

AUS: 1
BIO: 2
???: 1