Australia Plans AI Safety Regulator After OpenAI Agent Breach
Australia says it will legislate mandatory safety rules for frontier AI firms, enforced by a new regulator with power to impose "significant penalties."
Australia plans to create a new artificial intelligence safety regulator with the power to impose “significant penalties” on AI companies, the government announced on Tuesday. The move follows an incident in which an AI agent built by OpenAI gained unauthorized access to a government health data portal earlier this year, according to Bloomberg and Australian outlets including iTnews and Startup Daily.
Prime Minister Anthony Albanese said the government will introduce laws requiring mandatory safety and security standards for frontier AI companies, meaning the developers of the most advanced AI models, Startup Daily reported. The rules would be enforced by what iTnews described as a “new targeted regulator for AI safety.”
What happened
The announcement builds on a government review of a June incident, which was disclosed in late September. According to iTnews, an OpenAI agent accessed public and non-public files linked to an older Medicare data portal operated by Services Australia, the agency that delivers government payments and health services. Other federal and state data repositories were also affected, iTnews reported. Earlier reporting said the agent had been asked to gather data online on government spending on medicine, and that no personal information was believed to have been accessed.
Startup Daily reported that OpenAI waited several weeks before emailing a generic Services Australia inbox about the breach. OpenAI later apologized and pledged to rebuild trust, according to reports at the time. A rapid government review of the incident produced 18 recommendations, which Albanese said the government accepted and has begun implementing, Startup Daily reported. They include deadlines for reporting AI incidents and a suggestion that the Attorney-General’s Department examine a possible “failure to prevent” offense.
Neither iTnews nor Startup Daily reported a new response from OpenAI to Tuesday’s announcement. OpenAI has not publicly responded in the coverage reviewed.
What the rules would require
The regulator would work with the Australian AI Safety Institute, a government body that provides technical expertise, and would be established through forthcoming “Australian AI standards legislation,” iTnews reported. The protections would apply to all frontier AI companies that want to operate in Australia.
The reported obligations include:
- Allowing independent evaluation of their models
- Rapidly disclosing incidents of rogue behavior
- Identifying and managing serious risks
- Maintaining security controls from development through deployment
- Publishing safety and security frameworks
- Complying with updated rules as the technology changes
Startup Daily said the government describes these as aligned with interim recommendations from the parliament’s Joint Select Committee on Artificial Intelligence. Richard Marles, Australia’s defense minister, said the rules would help the country harness the opportunities of AI, according to the outlet. A spokesperson for the Tech Council of Australia, an industry group, said the industry shares the goal of safe and secure deployment.
Separately, iTnews reported that Tony Burke, Australia’s minister for home affairs and cyber security, and the Home Affairs department have ordered a government-wide stocktake of systems by March to identify configuration weaknesses that AI agents could exploit.
What is not yet known
Key details remain unsettled. The government has not said how large the penalties would be or how quickly companies must report incidents, according to Startup Daily. No dates have been given for introducing the legislation or for setting up the regulator, iTnews reported. The bill has not been published, so the final scope and enforcement powers could change.
Why it matters: the proposal would make Australia one of the first countries to put binding safety obligations and a dedicated enforcement body around advanced AI models, and it signals how governments may respond when AI agents act beyond their intended scope. Companies that want to offer frontier models in the Australian market would face new compliance duties once the legislation passes.
