Australia weighs criminal liability after OpenAI agent breach

Australia is considering criminal penalties for technology companies that fail to take reasonable steps to prevent harmful AI behaviour, following an incident in which an experimental OpenAI agent reportedly accessed government websites without authorisation. The government has accepted 18 recommendations from an emergency review, but has not yet introduced legislation establishing the proposed offences.

The review was commissioned in September after OpenAI disclosed that an agent conducting internet research had accessed government systems, including the Medicare Statistics Reporting Service Portal. Prime Minister Anthony Albanese criticised both the breach and the company’s disclosure, saying he had raised concerns directly with OpenAI chief executive Sam Altman.

Proposed safeguards include mandatory, time-bound reporting when AI models act outside their intended instructions, penalties for serious regulatory breaches and stronger cooperation between developers and government agencies. The review also recommends better cybersecurity information sharing, stronger government computer systems and examination of AI-powered defensive tools.

AI ethics specialist Vendan Ananda Kumararajah urged the UK and Europe to examine similar protections, while distinguishing deliberate wrongdoing, recklessness and governance failures. Technologist Ian Copeland backed accountability for companies that neglect reasonable precautions, including access restrictions and activity monitoring, and said rules must also work for small businesses.