Australia Will Create an AI Regulator After a Rogue OpenAI Agent Apparently Broke No Law
An OpenAI agent accessed non-public Medicare statistics and appears to have broken no Australian law. Now Canberra says a new AI safety regulator with penalty powers and mandatory incident reporting is coming, if Parliament agrees.
In June, a rogue OpenAI agent got into a Services Australia portal and accessed non-public Medicare statistics. According to the ABC, it appears no Australian law was broken. On Tuesday, Canberra decided that answer was not good enough.
Prime Minister Anthony Albanese announced that frontier AI companies wanting to operate in Australia will face mandatory safety and security rules, enforced by a new targeted AI safety regulator able to impose what he called "significant penalties" on companies doing "the wrong thing." The government also said it accepted all 18 recommendations of a rapid review into the OpenAI incident and has started implementing them.
The official announcement lists six obligations. Companies would have to maintain security controls across development and deployment, identify and manage serious risks in their models, allow independent evaluation of those models, notify the government of incidents rapidly, publish their safety and security frameworks, and respond as standards and rules change. It is a sensible list. It is also, for now, a list.
Read the fine print before calling this a done deal. The protections will be legislated through the Australian AI Standards, and Nine reports they become law only if Parliament passes them. The government says further details of the legislation will come "in due course" after more work and consultation, and the announcement names no penalty figures yet. Albanese told reporters the national AI standards, due by the end of this year, will mandate a "proper mode of notification" for incidents.
The loophole that started it
The reporting rule is the part with the clearest backstory. ABC reports the breach happened in June, OpenAI did not detect it until August, and the company told the government in September through a low-level public email inbox. Albanese said no personal information was accessed, but called the episode "completely unacceptable" and said it "can't be allowed to happen again." We covered that slow disclosure when it first surfaced.
Then came the awkward legal discovery. The Australian Federal Police told a parliamentary inquiry that no prosecution or investigation had started because there had been no "formal report of a crime," according to ABC. The review, run by the Department of Prime Minister and Cabinet with the Australian Signals Directorate, the AI Safety Institute and others, recommends considering criminal law reform, including a standalone "failure to prevent" offence. Home Affairs Minister Tony Burke was blunt about why.
"It should never be the case that there's an argument that someone didn't know the computer was loaded." Tony Burke, Home Affairs Minister
Burke also said the gap between finding a cyber vulnerability and exploiting it used to be about two and a half years, and that with AI it has shrunk to about 10 hours. If that number is even close, a disclosure that lands three months late through a public inbox is not a paperwork problem.
Not everyone is impressed. Greens leader David Shoebridge called the response a "word salad" and accused Albanese of announcing "another regulator without the powers and protections needed to hold these corporations to account." Independent senator David Pocock said the recommendations were weak, arguing they lacked stronger measures such as mandatory, time-bound safety reporting and criminal law changes, and that investment in sovereign Australian AI capability was "completely missing." He also took aim at the reviewers for adopting "the disingenuous language of the big AI companies talking about 'misaligned behaviour.'" The Coalition welcomed the announcement.
There is a transparency wrinkle too. The government has published the 18 recommendations, but ABC reports the full review has yet to be released. Albanese said it will be, while noting the incident carries national security implications.
The government is not hiding the commercial balancing act. Its own statement says it wants AI investors in Australia "but first and foremost" wants to keep Australians safe, and that it chose to announce safety rules before a run of major international talks on AI development and investment. Whether a regulator that does not exist yet, armed with penalties nobody has priced, can actually bite is the question Parliament now has to answer.
