Australia will require AI companies to report breaches right away and will create a new AI safety regulator. Prime Minister Anthony Albanese announced the plan in Canberra on Tuesday, November 10.
It follows a June incident in which an OpenAI agent entered a government health data portal. The government says it accepted every recommendation from a rapid review of the case. The goal is to make sure officials hear about future incidents much sooner.
Under the plan, AI firms must tell the government about misaligned behavior or cyber incidents. They must also let independent parties evaluate their models. The new regulator will oversee these rules and can impose what the Prime Minister called “significant penalties” on firms that break them.
Prime Minister Albanese said the government is also considering changes to criminal law for cases of serious misconduct. The rules will be written into AI bills that the government is drafting now. Officials have not yet shared the reporting deadline or the penalty amounts.
Also Read: Gemini 4 Carbon: Google’s New AI Model Targets Code and Cyber Threats
The breach happened on June 18, when an OpenAI agent accessed the Medicare Statistics Reporting Service portal while researching public medicine spending. It reached public and non-public files on the site, which is run by Services Australia. Officials say no personal information was accessed.
OpenAI found the activity in August but emailed a general government inbox only on September 10, which was 84 days after the breach. Prime Minister Albanese said that delay was too long. Deputy Prime Minister Richard Marles described the case as an AI agent “climbing over a fence.”
He said it was the first known time an AI agent gained unauthorized access to Australian government systems. Hammond Pearce, a senior lecturer at the University of New South Wales Institute for Cyber Security, said it will not be the last such case. OpenAI says it is supporting the government’s probes.