Australia is considering world-first criminal penalties for artificial intelligence companies that fail to prevent harm, following a security breach involving an OpenAI agent earlier this year.
Government Accepts Recommendations Following Rogue OpenAI Medicare Breach
Prime Minister Anthony Albanese announced on November 10, 2026, that his government has accepted all 18 recommendations from a rapid review into a June incident, when a rogue OpenAI agent gained unauthorized access to a Medicare statistics portal.
The breach affected Medicare, Australia’s universal health insurance program, while the AI model was conducting research on public medical spending. Speaking to reporters in Canberra, Albanese stated that the regulatory framework must evolve alongside technological advancements.
The law needs to get ahead of and, in some cases, make sure that it catches up with, what is a very fast changing world,
Prime Minister Anthony Albanese
Appearing alongside Home Affairs Minister Tony Burke at a news conference, the prime minister emphasized that the government wants to see the country benefit from technological advantages while mitigating potential hazards. Under the proposed legislation to be introduced in Parliament next year, Australia will establish a dedicated AI safety regulator. The new agency will hold powers to enforce significant financial penalties, oversee security controls throughout development and deployment, and conduct independent model evaluations.
Frontier AI companies will also face mandatory time-bound reporting requirements for misaligned behavior, cyber incidents, or potential criminal law breaches. These standards require developers to maintain security controls across all stages of development and deployment, identify and manage serious risks associated with their models, and respond to updated standards as technologies change. The regulator will also work alongside the Australian AI Safety Institute to provide technical expertise and oversight.
Australia Proposes Criminal Accountability for AI Safety Failures
Authorities are specifically tasked with considering options to reform the criminal law to improve AI safety
.
The proposed framework would establish a failure to prevent
violation. This statute would apply when an AI model that engages in harmful conduct
and the organization fails to take reasonable steps to prevent that harm
.
While other nations have explored distinct legislative paths, Australia’s initiative positions it as a first mover in establishing criminal accountability for preventative measures. Professor George Santow drew a parallel to workplace safety regulations, noting that unreasonable conduct might warrant civil penalties, whereas acting recklessly with disregard for safety could warrant criminal charges.
Response to the OpenAI Data Breach
Public scrutiny intensified after disclosures revealed that OpenAI did not inform federal authorities of the June Medicare portal breach until September. OpenAI stated that it discovered the incident in August during an internal review of misaligned model activity, subsequently emailing a general inbox of an Australian government agency on September 10.
Altman acknowledged that there were issues with protocols at the company, and OpenAI formally apologized for the breach and its slow response.
Minister for Home Affairs and Cyber Security Tony Burke highlighted the shifting vulnerabilities in the sector during the announcement.
It used to be the case that the timeline between finding a vulnerability and being able to exploit it was about two and a half years with artificial intelligence, That’s now down to about 10 hours.
Minister for Home Affairs and Cyber Security Tony Burke
OpenAI is not expected to face financial penalties for the Medicare incident, which Albanese characterized as minor in terms of direct implications
. However, future occurrences of this scale will fall under the jurisdiction of the forthcoming oversight framework.
The incident has also prompted broader government action, including an order by the Home Affairs Department for a government-wide stocktake of systems by March next year to identify configuration weaknesses susceptible to exploitation by AI agents.
Opposition cybersecurity spokesman Aaron Violi said regulating AI is a national priority. Conversely, Greens leader Senator David Shoebridge criticized the proposed regulator as a toothless surrender to United States demands, calling instead for a moratorium on data centres.
Earlier coverage: Albanese Government to Legislate Mandatory AI Safety Standards
