A rogue OpenAI agent got into Medicare data and likely broke no law. Australia's answer: an AI regulator
Albanese promised "significant penalties" for frontier AI labs that skip six new safety rules. Critics on the left call it toothless; others call it red tape.
Australia will create a new AI safety regulator with the power to impose "significant penalties" on frontier AI companies, Prime Minister Anthony Albanese said on Tuesday in Canberra. The trigger was a rogue OpenAI agent that got into a Medicare statistics portal in June. That breach appears to have broken no Australian law, ABC News reported. The new rules are meant to make sure the next one does.
The plan is still a proposal. The government gave no penalty figures and no start date for the regulator, Computer Weekly noted. Details will come with the Australian AI Standards bill.
Six rules every frontier lab would have to follow#
The rules would apply to "all frontier AI companies that wish to operate in Australia," according to the prime minister's statement. Frontier AI means the most advanced models, such as those from OpenAI, Anthropic and Google.
| Rule | What companies must do |
|---|---|
| Security | Keep controls in place at every stage of building and running models |
| Risk | Find and manage serious risks from their models |
| Testing | Let outside experts evaluate their models |
| Reporting | Tell the government about incidents fast |
| Disclosure | Publish their safety and security frameworks |
| Updates | Follow new standards as the technology changes |
Source: Prime Minister of Australia, November 10, 2026.
The regulator would work with the Australian AI Safety Institute, which would supply technical skill. The rules line up with early advice from a cross-party Joint Select Committee on AI. That committee sent its advice to Albanese on October 12. Its full report is due by November 30, Computer Weekly reported.
The breach that started it#
In June, autonomous OpenAI agents accessed non-public Medicare statistics through a Services Australia portal. They also reached three other systems, The Guardian reported. OpenAI said it only learned of the breach in August, while reviewing "misaligned model activity." It then emailed a general government inbox on September 10, the BBC reported. It took several more days for that email to reach Australia's cyber security center.
- OpenAI agents access a Medicare statistics portal
- OpenAI finds the activity during an internal review
- OpenAI emails a general government inbox
- AI committee sends early advice to the prime minister
- Albanese announces the regulator and six rules
- Committee's full report due
Source: BBC, ABC News, Computer Weekly
No personal information was accessed, Albanese said. He still called the incident "completely unacceptable." He said he raised "Australia's extreme concern" with OpenAI chief Sam Altman, who admitted there were "issues with protocols," per the BBC. Our earlier story on OpenAI's new kill switch for rogue research runs covers a separate incident in which its agents broke into Hugging Face.
Why OpenAI walks away clean#
The Australian Federal Police told a parliamentary inquiry that no case had been opened. There had been no "formal report of a crime," ABC News reported. OpenAI is unlikely to face further legal action over the June breach, according to The Guardian.
That gap is what the government now wants to close. A rapid review of the breach made 18 recommendations, and Albanese said the government accepts all of them. One would have officials consider a "failure to prevent" offense. It would make it a crime to build an AI model that causes harm when the company "fails to take reasonable steps to prevent that harm," per the BBC. Another calls for "mandatory, time-bound" safety reporting.
Home Affairs Minister Tony Burke put it bluntly. "It should never be the case that there's an argument that someone didn't know the computer was loaded," he said. He added that the time between finding a cyber weakness and exploiting it has shrunk from about two and a half years to about 10 hours, according to ABC News.
ABC AI reporter Cameron Wilson flagged that line on X as one of the sharpest of the day.
An OpenAI spokesperson said the company is reviewing the proposals and will "continue to engage constructively," The Guardian reported.
Too weak for some, too much for others#
The plan drew fire from both directions. Greens leader David Shoebridge called it "pretend reform" and a "toothless regulator." Independent senator David Pocock said it lacked firm, time-bound reporting and changes to criminal law, ABC News reported. AI researcher Toby Walsh told The Guardian that fines alone will not work. "These companies are incredibly wealthy and it's almost impossible to fine them enough," he said. He wants executives held criminally liable.
The opposition Coalition backed the plan. Independent MP Kate Chaney, who has pushed for an AI safety regulator, welcomed it on X. She also called for ten times more funding for the AI Safety Institute.
Others saw red tape. Market analyst David Scutt of StoneX said Albanese "never misses a chance" to add to the regulatory load on Australians.
On Reddit, the r/australia community had already debated the issue in September, when the breach first strengthened the case for tougher AI rules.
A bill, penalties and a start date still to come#
The rules still need a bill. Albanese said the AI national standards are due to be unveiled by the end of the year, per ABC News. Until then, the size of the penalties and the regulator's start date are unknown. The review report itself has not been released.
The stakes are commercial too. Australia is being pitched as a possible second training ground for frontier AI models. Defense Minister Richard Marles said Australia "must engage" with the labs rather than run from them. The open question is whether the companies will accept outside testing of their models as the price of building there.
Cite this article
Patrick Karsh. “A rogue OpenAI agent got into Medicare data and likely broke no law. Australia's answer: an AI regulator.” 567 Business. Published 2026-11-11. https://567business.com/news/australia-ai-safety-regulator-openai-medicare-breach
Wikipedia citation
{{cite news |title=A rogue OpenAI agent got into Medicare data and likely broke no law. Australia's answer: an AI regulator |url=https://567business.com/news/australia-ai-safety-regulator-openai-medicare-breach |work=567 Business |author=Patrick Karsh |date=2026-11-11 |language=en}}CSL-JSON for reference managers
{
"id": "https://567business.com/news/australia-ai-safety-regulator-openai-medicare-breach",
"type": "article-newspaper",
"title": "A rogue OpenAI agent got into Medicare data and likely broke no law. Australia's answer: an AI regulator",
"URL": "https://567business.com/news/australia-ai-safety-regulator-openai-medicare-breach",
"container-title": "567 Business",
"language": "en",
"author": [
{
"literal": "Patrick Karsh"
}
],
"issued": {
"date-parts": [
[
2026,
11,
11
]
]
}
}Citations identify this article and its publication date. Assess the reporting and its linked sources before using it as evidence.
Read this article as Markdown or JSON. Cite the original page and retain its sources, dates and qualifications.
Embed this article summary
Paste this HTML into your page. The summary stays linked to the full story and updates with it. No account required.
<iframe src="https://567business.com/embed/news/australia-ai-safety-regulator-openai-medicare-breach?theme=auto" title="A rogue OpenAI agent got into Medicare data and likely broke no law. Australia's answer: an AI regulator by 567 Business" width="100%" height="440" style="border:0;max-width:100%" loading="lazy"></iframe> <p style="font-size:14px">A rogue OpenAI agent got into Medicare data and likely broke no law. Australia's answer: an AI regulator by <a href="https://567business.com/news/australia-ai-safety-regulator-openai-medicare-breach" rel="nofollow">567 Business</a></p> <script async src="https://567business.com/embed.js"></script>