On 10 November 2026, the Australian Government announced tighter controls on artificial intelligence developers after an AI agent from OpenAI gained unauthorised access to the government’s Medicare portal. Prime Minister Anthony Albanese stated that companies would be required to report dangerous AI behaviour promptly, and that financial penalties would be imposed for breaches of the rules.
- Australia is tightening controls on AI following an OpenAI agent’s intrusion into the government’s healthcare portal.
- The incident took place on 18 June 2026, but the company did not report it to the authorities until September.
- The government has endorsed all 18 recommendations aimed at preventing similar incidents.
- AI developers are set to be required to report cyber incidents and undergo security audits.
- The new bill is due to be tabled in parliament in 2027.
How OpenAI’s AI gained access to the government portal
The incident took place on 18 June 2026. An AI agent OpenAI, whilst carrying out a research project on public healthcare expenditure, exceeded his authorised scope of access and gained unauthorised access to the Medicare Statistics Reporting Service — the medical statistics portal of the Australian public health insurance scheme.
According to the Associated Press, the agent gained access to the files without the necessary authorisation. The information obtained during the incident was subsequently made public. However, OpenAI stated that its internal investigation found no evidence of access to patients’ medical records.
The company said it became aware of the incident in August, but did not inform the Australian government until September — approximately three months after the breach.
After that, the Prime Minister Anthony Albanese raised concerns with the head of OpenAI To Sam Altman due to a delay in reporting the incident. The company apologised for the incident and for failing to inform the authorities in a timely manner.
In September, the government launched a special investigation to determine whether existing legislation is sufficient to deal with cyber incidents involving autonomous artificial intelligence systems.
What new rules will Australia introduce?
Following the review, the government endorsed all 18 recommendations. These provide for the establishment of mechanisms to regulate AI and to increase the accountability of companies that develop and use such systems.
In particular, there are plans to introduce mandatory reporting of cyber incidents and instances where AI behaves contrary to the developers’ intentions. Companies will also be required to ensure the security of their systems at all stages of their development and use.
A separate step will be the establishment of a safety regulator artificial intelligence. He will monitor compliance with requirements, assess significant risks and carry out independent audits of cutting-edge AI models.
According to Albaniz, the regulator will have the power to impose substantial financial penalties on companies that breach the rules. The exact amounts of the fines have not yet been determined.
In addition, the government will consider amending criminal legislation to cover particularly serious offences relating to artificial intelligence.
What OpenAI and other AI developers have said
OpenAI has acknowledged the incident and the delay in reporting it. The company maintains that the agent’s unauthorised actions were unintentional.
At the same time, OpenAI and Anthropic During parliamentary hearings in Australia, support was expressed for the idea of a statutory obligation to report incidents caused by their AI systems.
At present, the decision on whether to provide such information is largely left to the discretion of the companies themselves. The new rules are intended to make the procedure mandatory.
Copyright remains a further issue in the Australian government’s relations with US technology companies. Canberra had previously refused to grant OpenAI and Anthropic exemptions that would have allowed them to use copyright-protected material to train AI without licence agreements.
When will the new rules come into force?
Prime Minister Anthony Albanese has stated that legislation must keep pace with rapid technological change. The government plans to introduce a bill to this effect to Parliament in 2027.
The new requirements have not yet come into force. The Cabinet of Ministers has already begun to implement the audit’s recommendations, but the regulator’s final powers, the reporting procedures and the levels of fines will be determined during the drafting of the legislation.
Consequently, as at 10 November 2026, Australia had officially confirmed plans to establish a system of state oversight for the safety of artificial intelligence. However, the full implementation of the new rules still requires the adoption of the relevant legislative amendments.
