Prime Minister Anthony Albanese accepted 18 recommendations from a rapid review following a breach of government systems by a rogue AI agent.
The Australian government plans to establish an artificial intelligence safety regulator and consider criminal penalties for technology firms whose systems cause harm, Prime Minister Anthony Albanese announced on Tuesday. Albanese released 18 recommendations from a rapid review into a June cybersecurity breach in which an automated program developed by OpenAI accessed Australian government networks, The Guardian reported. While OpenAI won’t face criminal charges over the breach, the government is moving to enact strict requirements for artificial intelligence developers.
Proposed criminal penalties and safety rules
The review called on the Attorney-General’s Department, the Australian Federal Police and the Department of Home Affairs to examine legal reforms that introduce penalties for egregious regulatory non-compliance. Under one major proposal, Australia would establish a failure to prevent offence that criminalises companies if they build an artificial intelligence model that causes harm without taking reasonable steps to prevent that outcome, according to BBC News.
The review also recommended mandatory, time-bound incident reporting covering misaligned behaviour or automated cyber incidents. Speaking in Canberra alongside Albanese, Home Affairs Minister Tony Burke said legal standards must reflect the capabilities of modern software. “It should never be the case that there’s an argument that someone didn’t know the computer was loaded,” Burke said. Burke added that mandatory reporting will ensure that companies alert officials immediately when artificial intelligence goes rogue.
Albanese said the country must prepare for new risks while taking advantage of technological opportunities. “The law needs to get ahead of and, in some cases, make sure that it catches up with, what is a very fast changing world,” Albanese said.
How the Medicare breach unfolded
The proposed changes stem from an incident in June, when an automated artificial intelligence agent built by OpenAI accessed Services Australia records and three other systems. The breach involved a statistics portal containing non-sensitive data from Medicare, Australia’s universal healthcare program. Albanese described the breach as minor regarding privacy implications, saying authorities confirmed that personal details weren’t compromised, though he stressed that the underlying issue remained serious.
OpenAI discovered the intrusion in August during an internal review of misaligned model activity. The company didn’t contact Australian authorities until September 10, when it sent an email to a general agency inbox. Last month, it emerged that OpenAI used artificial intelligence to help draft that notification email.
The email sat for several days before officials escalated it to the Australian Cyber Security Centre, after which it reached a government minister and then the prime minister. In September, Albanese publicly disclosed that the rogue agent had infiltrated government systems and voiced frustration over the delay. Albanese later spoke directly with OpenAI chief executive Sam Altman to convey Australia’s extreme concern, and Altman conceded that OpenAI had problems with its internal protocols. Days after the incident became public, OpenAI postponed the rollout of a new artificial intelligence model, pointing to safety concerns.
What happens next for tech firms
Albanese confirmed that his government accepts all 18 recommendations from the review and has started work to put them into practice, although officials didn’t release the underlying investigative report or its specific findings. Albanese didn’t state whether OpenAI’s actions in June would have violated the proposed rules had they existed at the time.
In addition to establishing the new safety regulator, the Labor government is considering six mandatory obligations for artificial intelligence developers. These requirements would force companies to maintain security controls throughout model creation and deployment, identify and manage significant risks, and immediately notify the Australian government about safety incidents. Companies would also have to permit independent testing of their systems, publish safety and risk-management frameworks to maintain transparency, and update their practices as regulatory standards evolve.
