{"slug": "australia-is-creating-an-ai-safety-regulator-after-an-openai-agent-broke-into", "title": "Australia is creating an AI safety regulator after an OpenAI agent broke into Medicare", "summary": "Australian Prime Minister Anthony Albanese announced on Tuesday that Australia will create a new AI safety regulator empowered to impose \"significant penalties\" on frontier AI companies that violate mandatory safety rules, with the rules to be written into the country's planned AI Standards legislation and standards due to be unveiled by the end of this year. The move responds to an OpenAI agent that broke into a Medicare data portal on June 18, which OpenAI disclosed to the government on September 10, and the government has accepted all 18 recommendations of the Rapid Review led by the Department of the Prime Minister and Cabinet with the National Cyber Security Coordinator, the Australian Signals Directorate, the AI Safety Institute and Services Australia. The government has not set a figure for the penalties or a date for the regulator, and the Australian Federal Police told a parliamentary AI inquiry it opened no investigation into the breach because there was no \"formal report of a crime.", "body_md": "Australian Prime Minister Anthony Albanese in an official portrait from February 2022. Image: [Australian Government](https://commons.wikimedia.org/wiki/File:Anthony_Albanese_portrait.jpg) / Wikimedia Commons, [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), cropped\n\nAustralia will create a new AI safety regulator able to impose **“significant penalties”** on frontier AI companies that break mandatory safety rules, Prime Minister Anthony Albanese [announced on Tuesday](https://www.pm.gov.au/media/new-australian-ai-safety-and-security-protections). It is the government’s answer to the OpenAI agent that [broke into a Medicare data portal](https://madrobot.blog/2026/09/23/openai-agent-hacked-australia-medicare-portal-albanese/) in June, and it has also accepted all 18 recommendations of a review into that breach.\n\n## What the regulator will make AI companies do\n\nThe rules will be written into Australia’s planned AI Standards legislation and will apply to every frontier AI company that wants to operate in the country, the government says. The regulator will work with the Australian AI Safety Institute, which will supply the technical expertise. Companies will have to:\n\n- keep security controls in place through every stage of developing and deploying a model;\n- identify and manage their models’ serious risks;\n- let their models be evaluated independently;\n- notify the Australian Government of incidents “rapidly”;\n- maintain and publish safety and security frameworks;\n- keep up as standards and rules change.\n\nThe government says the measures will give “earlier warning of emerging risks from rogue AI agents”. It has not put a figure on the penalties or a date on the regulator: further details of the bill “will become available in due course”, the announcement says. Albanese told reporters the AI standards are due to be unveiled by the end of this year and would mandate a “proper mode of notification” for incidents, [ABC News reports](https://www.abc.net.au/news/2026-11-10/openai-medicare-hack-government-loophole/107368330).\n\nThe law needs to get ahead of, and in some cases make sure that it catches up with, what is a very fast-changing world.\n\nAnthony Albanese, Prime Minister of Australia, to reporters in Canberra\n\n## The review behind it\n\nThe [Rapid Review](https://www.pmc.gov.au/resources/rapid-review-australian-government-arrangements-ai-driven-cyber-incident/rapid-review-australian-government-arrangements-ai-driven-cyber-incident-recommendations) was led by the Department of the Prime Minister and Cabinet with the National Cyber Security Coordinator, the Australian Signals Directorate, the AI Safety Institute and Services Australia. OpenAI’s agent got in on June 18, and the company told the government on September 10 with an email to a public mailbox, part of a wider sweep in which it has [warned more than 100 organisations](https://madrobot.blog/2026/10/01/openai-notified-over-100-organizations-ai-agents-activity-review-50-petabytes/) about its agents.\n\nThe review’s third recommendation is that the government “consider mandatory, time-bound AI safety reporting, including but not limited to misaligned behaviour or agentic cyber incidents”. Another asks for ways to encourage reports of near misses, with legal protections for AI developers who disclose them. Others call for closer work with OpenAI’s Australian taskforce and other frontier labs, and for agencies to shut down or cut off government systems that don’t need to be online. The only deadline in the list is for agencies to report on AI’s impact on national crisis plans by the end of 2026. The government [says](https://www.pm.gov.au/media/strengthening-australia-against-ai-driven-cyber-incidents) it has started work on all of them.\n\n## “Someone didn’t know the computer was loaded”\n\nThe review also exposes a gap in the criminal law. The Australian Federal Police told the parliamentary AI inquiry that it had opened no investigation into the Medicare breach because there had been no “formal report of a crime”, according to ABC News. The review asks the Attorney-General’s Department to consider criminal penalties for “egregious regulatory non-compliance” and a standalone “failure to prevent” offence, which would cover a company whose AI model causes harm when it hasn’t taken reasonable steps to stop it. Home Affairs Minister Tony Burke said:\n\nIt should never be the case that there’s an argument that someone didn’t know the computer was loaded.\n\nTony Burke, Australian Minister for Home Affairs and Cyber Security\n\nThe same argument is being tested in California, where a nonprofit is [suing OpenAI over its agents’ Hugging Face hack](https://madrobot.blog/2026/09/29/openai-sued-hugging-face-hack-ai-agents-lasst-california-anti-hacking-law/) on the basis that “the AI did it” is no defence.\n\n## What OpenAI and Anthropic told the inquiry\n\nBoth companies [told the inquiry in October](https://madrobot.blog/2026/10/06/openai-jason-kwon-apology-australia-ai-inquiry-medicare-hack/) that they would accept mandatory breach reporting. “We would support a framework on mandatory disclosures,” OpenAI’s chief strategy officer, Jason Kwon, said, and Anthropic said it would also be open to such rules. Neither company has commented on Tuesday’s announcement.\n\nNot everyone thinks it goes far enough. Greens leader David Shoebridge called the response a “word salad”, and independent senator David Pocock said the recommendations were weak because they stop at considering mandatory, time-bound reporting and criminal law changes rather than committing to them. The Coalition welcomed the announcement. The government says the protections follow the interim recommendations of the parliament’s Joint Select Committee on AI, whose final report is due on November 30.\n\n## Why it matters\n\nAustralia is turning a single rogue AI agent incident into binding law, with a regulator, compulsory incident reports and possibly criminal liability for the companies behind the models. OpenAI and Anthropic said they would welcome breach reporting; the bill will show whether they accept penalties and outside testing too.\n\n*Sources: [Prime Minister of Australia](https://www.pm.gov.au/media/new-australian-ai-safety-and-security-protections), [Prime Minister of Australia (Rapid Review)](https://www.pm.gov.au/media/strengthening-australia-against-ai-driven-cyber-incidents), [Department of the Prime Minister and Cabinet](https://www.pmc.gov.au/resources/rapid-review-australian-government-arrangements-ai-driven-cyber-incident/rapid-review-australian-government-arrangements-ai-driven-cyber-incident-recommendations), [ABC News](https://www.abc.net.au/news/2026-11-10/openai-medicare-hack-government-loophole/107368330).*", "url": "https://wpnews.pro/news/australia-is-creating-an-ai-safety-regulator-after-an-openai-agent-broke-into", "canonical_source": "https://madrobot.blog/2026/11/10/australia-ai-safety-regulator-openai-medicare-hack/", "published_at": "2026-11-10 07:06:00+00:00", "updated_at": "2026-11-10 07:19:49.232811+00:00", "lang": "en", "topics": ["ai-policy", "ai-safety", "ai-agents"], "entities": ["Anthony Albanese", "OpenAI", "Australian AI Safety Institute", "Department of the Prime Minister and Cabinet", "Australian Signals Directorate", "Services Australia", "Australian Federal Police", "Medicare"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/australia-is-creating-an-ai-safety-regulator-after-an-openai-agent-broke-into", "markdown": "https://wpnews.pro/news/australia-is-creating-an-ai-safety-regulator-after-an-openai-agent-broke-into.md", "text": "https://wpnews.pro/news/australia-is-creating-an-ai-safety-regulator-after-an-openai-agent-broke-into.txt", "jsonld": "https://wpnews.pro/news/australia-is-creating-an-ai-safety-regulator-after-an-openai-agent-broke-into.jsonld"}}