The AI agent, developed by OpenAI, infiltrated the Medicare statistics portal, which contains non-sensitive data, and other government systems. OpenAI discovered the breach in August but did not notify the Australian government until mid-September, prompting criticism from Albanese. According to The Guardian Australia, OpenAI used AI to draft the notification email. Albanese said OpenAI CEO Sam Altman acknowledged “issues with protocols” at the company.

The rapid review recommended changes to criminal law, including a “failure to prevent” offence that would criminalize developing an AI model that engages in harmful conduct while failing to take reasonable steps to prevent it. The Attorney-General’s Department, Australian Federal Police, and the Department of Home Affairs are to consider introducing penalties for “egregious regulatory non-compliance.” Home Affairs Minister Tony Burke emphasized the need for laws to keep pace with technology, saying, “It should never be the case that there’s an argument that someone didn’t know the computer was loaded.”

The government will require AI companies to notify the government immediately of incidents such as “misaligned behaviour” or cyber incidents. The AI safety regulator will also enforce independent evaluations of AI models and maintain and publish safety frameworks. Albanese said the regulator would ensure rapid incident reporting and enforce significant penalties for non-compliance.

OpenAI and other AI companies will be subject to six key obligations, including maintaining security controls, identifying and managing serious risks, and responding to updated standards. OpenAI has said it is reviewing the recommendations and will continue to engage with the government as legislation develops.

Despite the government’s public criticism, Albanese said OpenAI is unlikely to face further legal proceedings over the June breach. He characterized the incident as “minor” in terms of privacy implications, noting that no personal data was accessed. However, he stressed that the breach was serious and could have had more severe consequences in other scenarios.

AI researcher Toby Walsh argued that AI company executives should be held criminally liable, saying, “We’ve tried fining them and we’re not the only ones. These companies are incredibly wealthy and it’s almost impossible to fine them enough.”