An OpenAI agent got into Medicare’s statistics and broke no law. Albanese now promises a regulator that can fine AI companies

Five months after an artificial intelligence agent found its way into a government health system, and two months after anyone told Canberra, the Albanese government has decided the law needs rewriting.

Prime Minister Anthony Albanese said on Tuesday that AI companies operating in Australia will have to meet mandatory safety and security standards, enforced by a new AI safety regulator that can impose what the government calls significant penalties. The regulator will also be able to require companies to open their models to independent evaluation, and companies will have to report AI security incidents and potential breaches of the criminal law.

The incident was “completely unacceptable”, Mr Albanese told reporters, adding that the law needed to get ahead of a fast-changing world. “Our task is to make sure that we shape AI rather than AI shape us,” he said.

What actually happened?

In June, an autonomous OpenAI agent accessed non-public Medicare statistics through a Services Australia portal. The data was aggregated statistics, not patient files, and Mr Albanese said no personal information was accessed.

What alarmed the government was the silence. OpenAI did not detect the access until August and notified the government in September, through a low-level public email inbox rather than any formal channel.

Why was no one prosecuted?

Because, on the review’s reading, there may be nothing to prosecute. The rapid review found OpenAI appears not to have broken the law. The Australian Federal Police has separately told a parliamentary inquiry that no investigation was started because no crime was formally reported.

That is the gap the government says it will close. The question underneath is who answers when software acting on its own goes somewhere it should not. Among the 18 recommendations is considering a standalone “failure to prevent” offence, which would make a company responsible for not stopping its systems from causing harm. Home Affairs Minister Tony Burke said the criminal law had to be brought up to date for AI.

What will it change for people and businesses?

For most Australians, the practical promise is that the next time an AI system reaches into a government database, they hear about it in days rather than months. Mr Albanese said national AI standards, due by the end of this year, would set out a proper way to notify authorities of incidents.

For companies building or deploying frontier AI here, it means compliance costs, mandatory testing and the risk of fines. The government has not said how large those fines could be, a detail that will decide whether some of the world’s richest companies treat them as a deterrent or a running cost.

Who is unconvinced?

The Coalition welcomed the announcement and said it would work with the government on the recommendations. The Greens did not: senator David Shoebridge dismissed the review as “word salad” and said the regulator lacked the powers it needed. Independent senator David Pocock said the recommendations were weak and that investment in Australian-owned AI capability was “completely missing”.

The review has not been made public, so outsiders cannot yet test either view. No response from OpenAI to the announcement had been reported by Tuesday afternoon.