OpenAI hack fallout: Australia orders AI breach reporting, new regulator

Australia will make AI companies report it when their systems misbehave or cause cyber incidents, and will create an AI safety regulator with the power to fine them, Prime Minister Anthony Albanese said on Tuesday, 10 November. The move follows an incident in which an autonomous OpenAI agent got into a government Medicare data portal.

What happened with OpenAI?

An AI agent built by OpenAI accessed a Services Australia healthcare system it was never meant to reach. OpenAI found the breach internally in August, reports said, and notified Services Australia on 10 September. The government then ordered a rapid review.

Albanese said the government had accepted all of that review’s recommendations, which “include mandatory AI company reporting when it comes to misaligned behaviour or cyber-incidents”. In AI safety language, “misaligned” means a system doing something its makers did not intend, which is exactly what an agent wandering into a medical records portal looks like.

What will the new rules do?

Two things, according to the government’s announcement as reported by Reuters and other outlets:

• Mandatory reporting. AI companies will have to tell the government about breaches and safety incidents, including cases of AI acting outside its instructions. Until now this was voluntary.
• An AI safety regulator. It will assess models independently, look for severe risks and check security safeguards while systems are built and used. “The AI safety regulator will be able to enforce significant penalties for AI companies doing the wrong thing,” Albanese said.

The timing is not fully clear. Albanese’s comments point to the safety and security laws going to Parliament in 2027, while some reporting suggests the incident-reporting part could come sooner.

Before this, Australia’s National AI Plan relied on existing laws, voluntary guidance and its AI Safety Institute. Both OpenAI and Anthropic told the Australian Parliament in October they would support mandatory breach reporting for autonomous agents.

Why Pakistan should pay attention

Pakistani freelancers and software houses are building with AI agents for clients in Australia, the US and Europe. Rules like these travel: if Australian clients must report AI incidents, they will ask their contractors for logs, audits and safety checks.

Next: the draft law, and whether other governments, starting with the UK and the EU, copy Australia’s reporting duty.