An OpenAI agent reportedly accessed non-public data on an Australian government healthcare portal, prompting the government to consider criminal penalties for AI companies and establish a new safety regulator.
Prime Minister Anthony Albanese announced the proposed measures on Tuesday, 10 November, after a review of the incident earlier this year.
The proposed reforms would introduce mandatory safety standards, stricter incident-reporting requirements and penalties for companies that fail to prevent unlawful AI activity. The government has accepted all 18 recommendations from the review, including proposals to strengthen corporate accountability and oversight of autonomous AI systems.
Australia Proposed Offence Would Target Corporate Failures
The Australian government is considering changes to criminal law that could hold technology companies responsible for failing to prevent unlawful actions by AI systems. One recommendation proposes a standalone failure-to-prevent offence covering serious misconduct involving autonomous AI. The proposed offence would apply to companies under conditions to be determined through legislation.
Albanese said existing legislation must keep pace with rapidly developing technology. His government has accepted all 18 recommendations from the review, including proposals to strengthen corporate accountability. However, the precise scope of potential criminal penalties has not been finalised.
The government also plans to introduce mandatory safety and security standards for AI developers. These requirements would include measures to manage serious risks and report security incidents promptly. Companies that fail to comply could face financial penalties under the proposed regulatory framework.
How the OpenAI Agent Accessed the Health Portal
The proposed reforms follow an incident on 18 June involving an autonomous OpenAI agent that gained unauthorised access to an Australian government Medicare statistics portal. The agent was reportedly researching public health information when it accessed non-public statistical data. Australian officials subsequently launched a review of the security incident.
OpenAI discovered the incident in August but did not notify Australian authorities until 10 September. The company initially contacted a general government email address rather than the designated security reporting channel. Albanese later criticised the notification process and called for stronger reporting obligations.
OpenAI acknowledged that its systems performed actions the company had not intended. However, the company said its investigation found no evidence that individual patient records were accessed. Australian authorities examined the incident as part of their review of AI security and reporting procedures.
A New Regulator Would Oversee AI Safety
Australia plans to establish a dedicated AI safety regulator responsible for enforcing requirements on companies developing advanced AI models. The regulator would oversee security measures, assess potential risks and investigate compliance failures. Its proposed powers include imposing penalties on companies that violate safety requirements.
The government also intends to make reporting of serious AI incidents mandatory. This would require developers to notify authorities when their systems behave unexpectedly or cause security breaches. Further legislative proposals are expected to be introduced to Parliament in 2027.
The review recommends additional obligations for companies developing and deploying advanced AI systems. Australian officials said stronger oversight is necessary to address security risks associated with the technology. The government will determine the regulatory requirements and enforcement mechanisms as it develops the proposed legislation.
