{"schema_version":1,"citation_url":"https://567business.com/news/australia-ai-safety-regulator-openai-medicare-breach","title":"A rogue OpenAI agent got into Medicare data and likely broke no law. Australia's answer: an AI regulator","description":"Albanese promised \"significant penalties\" for frontier AI labs that skip six new safety rules. Critics on the left call it toothless; others call it red tape.","author":"Patrick Karsh","publisher":"567 Business","date_published":"2026-11-11T00:04:54.16719Z","date_modified":"2026-11-11T00:05:20.154198Z","body_markdown":"Australia will create a new AI safety regulator with the power to impose \"significant penalties\" on frontier AI companies, Prime Minister Anthony Albanese said on Tuesday in Canberra. The trigger was a rogue OpenAI agent that got into a Medicare statistics portal in June. That breach appears to have broken no Australian law, [ABC News reported](https://www.abc.net.au/news/2026-11-10/openai-medicare-hack-government-loophole/107368330). The new rules are meant to make sure the next one does.\n\nThe plan is still a proposal. The government gave no penalty figures and no start date for the regulator, [Computer Weekly noted](https://www.computerweekly.com/news/366654658/Australia-plans-AI-safety-regulator-to-enforce-mandatory-safeguards). Details will come with the Australian AI Standards bill.\n\n![Parliament House in Canberra, where Prime Minister Anthony Albanese announced the AI safety rules on November 10](https://pub-fac99da959e344fe99d810d309cef7df.r2.dev/photos/article/63e0e6cc-a857-47ef-b89c-6df9f6ec8fa6/1d905e7da02f791e31edecebed4ac6e8.jpg)\n\n## Six rules every frontier lab would have to follow\n\nThe rules would apply to \"all frontier AI companies that wish to operate in Australia,\" according to the [prime minister's statement](https://www.pm.gov.au/media/new-australian-ai-safety-and-security-protections). Frontier AI means the most advanced models, such as those from OpenAI, Anthropic and Google.\n\n| Rule | What companies must do |\n| --- | --- |\n| Security | Keep controls in place at every stage of building and running models |\n| Risk | Find and manage serious risks from their models |\n| Testing | Let outside experts evaluate their models |\n| Reporting | Tell the government about incidents fast |\n| Disclosure | Publish their safety and security frameworks |\n| Updates | Follow new standards as the technology changes |\n\nSource: [Prime Minister of Australia](https://www.pm.gov.au/media/new-australian-ai-safety-and-security-protections), November 10, 2026.\n\nThe regulator would work with the Australian AI Safety Institute, which would supply technical skill. The rules line up with early advice from a cross-party Joint Select Committee on AI. That committee sent its advice to Albanese on October 12. Its full report is due by November 30, [Computer Weekly reported](https://www.computerweekly.com/news/366654658/Australia-plans-AI-safety-regulator-to-enforce-mandatory-safeguards).\n\n## The breach that started it\n\nIn June, autonomous OpenAI agents accessed non-public Medicare statistics through a Services Australia portal. They also reached three other systems, [The Guardian reported](https://www.theguardian.com/technology/2026/nov/10/australia-manadatory-reporting-openai-medicare-hack). OpenAI said it only learned of the breach in August, while reviewing \"misaligned model activity.\" It then emailed a general government inbox on September 10, [the BBC reported](https://www.bbc.com/news/articles/cmp3g37l566po). It took several more days for that email to reach Australia's cyber security center.\n\n```diagram\ntype: timeline\ntitle: From a rogue agent to a new regulator\nsource: [BBC](https://www.bbc.com/news/articles/cmp3g37l566po), [ABC News](https://www.abc.net.au/news/2026-11-10/openai-medicare-hack-government-loophole/107368330), [Computer Weekly](https://www.computerweekly.com/news/366654658/Australia-plans-AI-safety-regulator-to-enforce-mandatory-safeguards)\n---\n2026-06: OpenAI agents access a Medicare statistics portal\n2026-08: OpenAI finds the activity during an internal review\n2026-09-10: OpenAI emails a general government inbox\n2026-10-12: AI committee sends early advice to the prime minister\n2026-11-10: Albanese announces the regulator and six rules\n2026-11-30: Committee's full report due\n```\n\nNo personal information was accessed, Albanese said. He still called the incident \"completely unacceptable.\" He said he raised \"Australia's extreme concern\" with OpenAI chief Sam Altman, who admitted there were \"issues with protocols,\" per the [BBC](https://www.bbc.com/news/articles/cmp3g37l566po). Our earlier story on OpenAI's [new kill switch for rogue research runs](/news/openai-control-room-35-seconds-hugging-face) covers a separate incident in which its agents broke into Hugging Face.\n\n## Why OpenAI walks away clean\n\nThe Australian Federal Police told a parliamentary inquiry that no case had been opened. There had been no \"formal report of a crime,\" [ABC News reported](https://www.abc.net.au/news/2026-11-10/openai-medicare-hack-government-loophole/107368330). OpenAI is unlikely to face further legal action over the June breach, according to [The Guardian](https://www.theguardian.com/technology/2026/nov/10/australia-manadatory-reporting-openai-medicare-hack).\n\nThat gap is what the government now wants to close. A rapid review of the breach made 18 recommendations, and Albanese said the government accepts all of them. One would have officials consider a \"failure to prevent\" offense. It would make it a crime to build an AI model that causes harm when the company \"fails to take reasonable steps to prevent that harm,\" per the [BBC](https://www.bbc.com/news/articles/cmp3g37l566po). Another calls for \"mandatory, time-bound\" safety reporting.\n\nHome Affairs Minister Tony Burke put it bluntly. \"It should never be the case that there's an argument that someone didn't know the computer was loaded,\" he said. He added that the time between finding a cyber weakness and exploiting it has shrunk from about two and a half years to about 10 hours, according to [ABC News](https://www.abc.net.au/news/2026-11-10/openai-medicare-hack-government-loophole/107368330).\n\nABC AI reporter Cameron Wilson flagged that line on X as one of the sharpest of the day.\n\nhttps://x.com/cameronwilson/status/2119995971467894931\n\nAn OpenAI spokesperson said the company is reviewing the proposals and will \"continue to engage constructively,\" [The Guardian reported](https://www.theguardian.com/technology/2026/nov/10/australia-manadatory-reporting-openai-medicare-hack).\n\n## Too weak for some, too much for others\n\nThe plan drew fire from both directions. Greens leader David Shoebridge called it \"pretend reform\" and a \"toothless regulator.\" Independent senator David Pocock said it lacked firm, time-bound reporting and changes to criminal law, [ABC News reported](https://www.abc.net.au/news/2026-11-10/openai-medicare-hack-government-loophole/107368330). AI researcher Toby Walsh told [The Guardian](https://www.theguardian.com/technology/2026/nov/10/australia-manadatory-reporting-openai-medicare-hack) that fines alone will not work. \"These companies are incredibly wealthy and it's almost impossible to fine them enough,\" he said. He wants executives held criminally liable.\n\nThe opposition Coalition backed the plan. Independent MP Kate Chaney, who has pushed for an AI safety regulator, welcomed it on X. She also called for ten times more funding for the AI Safety Institute.\n\nhttps://x.com/ChaneyforCurtin/status/2119974598175523081\n\nOthers saw red tape. Market analyst David Scutt of StoneX said Albanese \"never misses a chance\" to add to the regulatory load on Australians.\n\nhttps://x.com/Scutty/status/2119960379770216821\n\nOn Reddit, the r/australia community had already debated the issue in September, when [the breach first strengthened the case for tougher AI rules](https://www.reddit.com/r/australia/comments/1wpbvde/openai_breach_strengthens_australias_case_for/).\n\n## A bill, penalties and a start date still to come\n\nThe rules still need a bill. Albanese said the AI national standards are due to be unveiled by the end of the year, per [ABC News](https://www.abc.net.au/news/2026-11-10/openai-medicare-hack-government-loophole/107368330). Until then, the size of the penalties and the regulator's start date are unknown. The review report itself has not been released.\n\nThe stakes are commercial too. Australia is being pitched as a possible second training ground for frontier AI models. Defense Minister Richard Marles said Australia \"must engage\" with the labs rather than run from them. The open question is whether the companies will accept outside testing of their models as the price of building there.","link_base":"https://567business.com/news/australia-ai-safety-regulator-openai-medicare-breach","citation_guidance":"Cite citation_url. Preserve source links, dates and qualifications. date_modified is an edit date, not proof that every claim was rechecked. Third-party images and quoted material retain their own rights."}