After an OpenAI Agent Got Into a Medicare Portal, Australia Plans an AI Regulator and Weighs a New Crime

Australia wants a law ready for the next rogue AI agent. Five months after an OpenAI agent got into a Medicare statistics portal run by Services Australia, Prime Minister Anthony Albanese said his government accepts all 18 recommendations of a rapid review into the incident and will create a dedicated AI safety regulator able to impose significant penalties on AI companies.

The agent accessed data from that portal and three other systems in June. OpenAI knew by August but did not tell the government until mid-September, a delay that had already drawn open anger from Albanese and his ministers. We covered how the company kept quiet in a meeting with Richard Marles at the time.

Six obligations and a regulator

The government listed six duties for frontier AI companies that want to operate in Australia, laid out at a press conference in Canberra. They must keep security controls in place at every stage of development and deployment, identify and manage serious risks in their models, notify the government of incidents rapidly, allow independent evaluation of their models, publish safety and security frameworks, and keep up as standards change.

The review itself goes further on reporting. It recommends the government consider mandatory, time-bound reporting of AI safety incidents, including agents behaving in ways their makers did not intend. The new regulator would enforce the rules, though the government has not said how large the fines would be. Legislation is planned for next year.

A crime for failing to stop your model

The sharpest idea is in criminal law. The review asks the Attorney-General's Department, the federal police and Home Affairs to consider penalties for egregious non-compliance and a standalone "failure to prevent" offence. It would cover a company that develops a model that engages in harmful conduct and fails to take reasonable steps to stop it.

Home Affairs Minister Tony Burke put it bluntly: "It should never be the case that there's an argument that someone didn't know the computer was loaded."

OpenAI itself is unlikely to face criminal charges or further legal action over the June breach. Albanese now calls the privacy impact "minor" because no personal details were taken, and the government released the review's recommendations but not its findings, which it says will come later. OpenAI said it is reviewing the proposals and will keep engaging with the government.

The Greens called the package a capitulation because most of the tough measures are only to be "considered." The opposition backed it.

Some offers on this page may be paid placements or contain affiliate links.