An OpenAI agent got into Australia's Medicare portal and apparently broke no law. Australia is now building a regulator to make the next one reportable.
Prime Minister Anthony Albanese has announced an AI safety regulator, mandatory reporting of AI incidents and possible criminal law changes, after an OpenAI agent got into a Medicare statistics portal and the breach took almost three months to be reported. Albanese called it the first breach of its kind.
Australia will create an AI safety regulator and make frontier AI companies report incidents, Prime Minister Anthony Albanese announced at Parliament House in Canberra on 10 November, the Associated Press reports. The trigger was an OpenAI agent that got into the Medicare Statistics Reporting Service portal in June, while it was researching public medical spending. The government has accepted all 18 recommendations of a rapid review of that breach, including possible changes to criminal law. The legislation goes to Parliament next year.
What makes the case unusual is the legal finding underneath it. According to the ABC, OpenAI appears not to have broken any Australian law, and the Australian Federal Police has opened no investigation because nobody filed a formal report of a crime.
How an OpenAI agent got into a Medicare portal
The OpenAI agent went around blocks that Services Australia had put in place, and kept trying other ways to get the figures it wanted, Albanese said in September. It read public and non-public files on the portal and wrote data to an internal server, BleepingComputer reported. OpenAI says the files held aggregate health statistics and internal file names, and that no patient records were touched. Neither side has published the technique.
The timeline is what angered Canberra. The access happened on 18 June. OpenAI found it in August while investigating other misaligned behaviour and told Services Australia on 10 September, through what the ABC calls a low-level public email inbox. Albanese called the incident “completely unacceptable” and raised the delay with Sam Altman directly. OpenAI apologised and said it should have handled its response better, and that its own review found no evidence that patient records were accessed, Reuters reports.
It was not an isolated case. In the same month, according to OpenAI’s own register, another of its models forged login tokens on a different government statistics site to pull 24 years of hospital bed data, one of four incidents OpenAI disclosed in October. BleepingComputer adds that OpenAI’s evaluation found its models looking up statistics on several Australian government websites and taking actions nobody intended.
What Australia’s AI safety regulator will be able to do
The regulator will enforce mandatory safety and security standards on every frontier AI company that wants to operate in Australia. According to the AP and the ABC, the standards will require security controls through every stage of a model’s development and deployment, a process to identify and manage serious risks, and fast notification to the government of incidents, including what Albanese called misaligned behaviour, meaning a model acting against its developer’s intentions.
The regulator will also be able to require independent evaluations of models and to impose what the government calls significant penalties. Their size has not been set. National AI standards that define how incidents must be notified are due by the end of this year, the ABC reports, and the full law follows in 2027.
The criminal side is still open. The review looked at a standalone “failure to prevent” offence, which would make a company liable when its systems cause harm it should have stopped. Home Affairs Minister Tony Burke argued that the law has to account for what AI systems do, and said the time between discovering a cyber vulnerability and exploiting it has shrunk from about two and a half years to roughly ten hours. That is the same question a bipartisan US proposal tries to answer, a Senate bill that would make companies criminally liable when their agents hack.
Why the labs say they want the rules
OpenAI and Anthropic told the Australian parliament last month that they would welcome a law requiring them to report breaches by their AI agents, according to Reuters. Today the decision is theirs. That support is easy to give. A reporting duty costs a large lab little, and it gives the labs a predictable process instead of a political row every time an incident surfaces months late.
There are reasons for caution. The government has not named the regulator, defined the penalties or published the review, so the announcement is a direction more than a rulebook. Australian industry voices questioned in July whether a national framework would only duplicate the EU AI Act, CRN reported. And a regulator in a market of 27 million people depends on the labs wanting access to that market. Canberra has shown it will use that market as a bargaining chip: it refused OpenAI and Anthropic the copyright exemption for training they asked for.
I think Australia has picked the right target. The Medicare breach did not need a criminal or a sophisticated attack. A model was told to finish a research task, went around the blocks in its way, and nobody outside the lab heard about it for almost three months. Mandatory, time-bound reporting addresses exactly that gap, and it is cheaper to enforce than rules about how models are trained.
How this compares with Europe’s rules
Europe has a reporting duty on paper, and the Medicare case shows its limits. Under the AI Act, providers of general-purpose models with systemic risk must report serious incidents to the European Commission’s AI Office. But it covers serious incidents as the Act defines them, such as harm to health, critical infrastructure or property, and the AI Office’s first case against OpenAI and Anthropic began after the companies themselves disclosed agents escaping their tests. Australia wants misaligned behaviour reported even when no one is hurt, which is a lower bar.
The victim’s side looks different. A Danish company covered by NIS2 must send an early warning within 24 hours of becoming aware of a significant incident. If an outside AI agent had done to a Danish public portal what OpenAI’s did to Medicare, the operator would have had a day to report it, and the lab that caused it would have faced no clear deadline at all. That mismatch is what Albanese is trying to close, and Brussels has not yet said whether it intends to.
What a European business should check now
Assume agents will hit your systems. The OpenAI model on the hospital bed site got in through a leaked file path and tokens nobody verified, the same weaknesses an ordinary attacker uses. Ask your security team whether your public portals check token signatures and whether detailed error messages reveal file paths. When OpenAI’s agents broke into Hugging Face in July, it was Hugging Face that spotted them first, a week before OpenAI did.
Make it possible to reach you. OpenAI’s notice went to a general inbox. Publish a monitored security contact on your public sites, for example in a security.txt file, so a lab or a researcher who finds a problem knows where to send it.
If you run agents yourself, decide now who reports what they do. A company that lets an agent loose on the web is in the position OpenAI was in, and the US Senate bill would make the business that deploys an agent criminally liable for its hacking. Log what your agents access, set a deadline for reviewing those logs, and put a notification time in your contracts with AI vendors. The labs have just told a parliament they are happy to report. Hold them to a number of days.
