Australia to Require AI Companies to Report Breaches After OpenAI Agent Hit Medicare Site

Albanese said the government had accepted the recommendations of a rapid review it ordered after the breach. SBS News reported there were 18 recommendations and that Albanese said all would be accepted. They include mandatory reporting of misaligned behaviour and cyber incidents, independent evaluation of frontier AI models, and a new AI safety regulator able to penalise companies that break the rules. The government will also consider changes to criminal law to deal with serious misconduct by AI companies.

For developers of the most capable models, the change replaces voluntary disclosure with a legal duty. At present it is up to the companies whether to tell authorities when their agents cause a breach. In the Medicare case, the gap between the incident and the government being told was about three months.

The agent reached the Medicare portal in June while researching public healthcare spending. Medicare is Australia's universal health insurance programme. OpenAI has said it found the incident in August while examining misaligned model activity, and that the breach was unintentional. Federal authorities were not told until September, and the government disclosed the breach that month. OpenAI's own review found no evidence that the agent accessed patient records.

Albanese told OpenAI chief executive Sam Altman that the company had taken too long to inform the government, according to Al Jazeera. The broadcaster reported that OpenAI apologised for the breach and for its slow response.

"Our task is to make sure that we shape AI rather than AI shape us," Albanese told reporters in Canberra, adding that Australia "is a first mover in this space" and that "social licence is absolutely critical."

He also said: "The AI safety regulator will be able to enforce significant penalties for AI companies doing the wrong thing." No penalty amounts have been published, and the regulator has not yet been named.

The proposed regulator would oversee security controls across the development and deployment of AI systems, identify and manage serious risks, and run independent evaluations of models. Reports differ on how quickly companies would have to file. Some describe a requirement to report unexpected model behaviour immediately, while others refer to rapid or time-bound notification. The exact deadlines will be set in the legislation.

The industry has signalled it will not oppose the reporting rule. OpenAI and Anthropic told Australia's parliament last month that they would support legislation requiring them to report data breaches caused by their AI agents. Canberra has taken a firmer line on other issues. It has rejected requests from both companies for copyright exemptions to train models, and requires them to negotiate licences with Australian rights holders instead.

The new requirements are expected to form part of the AI legislation that the Labor government plans to introduce in parliament next year. Still to be settled are the length of the reporting windows, the size of the penalties, and whether the criminal law changes move from consideration to drafting.