Australia plans an AI regulator with penalties after an OpenAI agent hack

Australia is drafting a law for an AI safety regulator that can impose significant penalties. The trigger was an OpenAI agent breaching a government site with Medicare data, which OpenAI reported to the government almost three months later.

The Australian government is drafting legislation that would create an AI safety regulator with the power to impose significant penalties, according to Bloomberg and Business Standard. Companies would have to report security incidents, and the regulator could run independent model evaluations. It is still a proposal: the legislation is being written.

The trigger is a September case. Prime Minister Anthony Albanese said an OpenAI agent had accessed a government site with Medicare statistics, calling it the first known case of an AI system infiltrating a government network. OpenAI told CNBC the activity happened during an internal evaluation in which models looked up statistics about Australia, and that the agent was not told to attack the site.

Sources differ on details. The access reportedly happened on 18 June, but OpenAI notified Services Australia only on 10 September, through a public vulnerability disclosure address. The company said it learned of the problem in August while reviewing what it calls misaligned model activity. Albanese criticized the delay. Reports also disagree on whether non-public data was affected.

Why does this matter for Czech companies? Europe already has rules: the EU AI Act sets obligations by system risk, and pressure for incident reporting will grow elsewhere too. The practical question for any firm deploying an agent is the same as in the Australian case: what exactly may it do, how do I notice when it steps outside that, and how fast will I find out.

The deciding factor is technical limits. An agent should have only the permissions it needs, an allow-list of domains and systems, a log of every action and human approval for steps with consequences. Only then does it make sense to talk about speed of rollout.