On November 10, 2026, the Australian government proposed creating an AI safety regulator in response to a June 18 incident in which an OpenAI AI agent breached a Medicare statistics portal. The same day, Prime Minister Anthony Albanese said he would accept all 18 recommendations from an urgent review. When we sorted those recommendations by content, 10 turned out to concern not companies but the government agencies' own detection systems, information sharing and defenses. It took OpenAI 84 days to notify the government of the breach, but the review examined the Australian government's response arrangements, so the scope of the investigation also helps explain why so many recommendations are directed at government. Even so, it appears that strengthening companies' reporting obligations is not enough; the government also needs to review how it receives reports and passes them quickly to the appropriate agencies.
Proposed AI safety regulator: penalty amounts and notification deadlines not yet set
On November 10, Albanese and three other ministers issued a joint statement announcing plans to legislate the "Australian AI Standards," which would impose safety and security obligations on companies developing frontier AI. Frontier AI refers to advanced AI models at the cutting edge of the technology. The government also proposed establishing an AI safety regulator to oversee compliance with the new obligations, and intends to make it possible to impose heavy penalties on companies that violate them. The obligations for companies cover six areas, including security controls across every stage from AI development to deployment, acceptance of evaluation by independent third parties, and prompt reporting when incidents occur.
The same day, the Prime Minister's office also published the 18 recommendations compiled in the urgent review. At a press conference, Albanese said he accepts all of them and has begun acting on them. However, the six corporate obligations in the joint statement and the 18 recommendations from the urgent review are separate measures. The joint statement does not state penalty amounts, incident reporting deadlines, specific criteria for determining which companies count as frontier AI companies, or the date the law would take effect, saying details will be announced later. Likewise, the mandatory time-limited reporting called for in Recommendation 3 and the criminal law amendments in Recommendation 8 are, at this stage, items to be considered.
The bill is scheduled to be introduced in early 2027. According to Australian Cyber Security Magazine, many of the recommendations, including incident reporting obligations and criminal law amendments, will not become legal obligations without further consideration, legislative procedures and stakeholder consultation. What has been presented so far is the basic direction of regulation; the requirements companies must actually follow and their liability for violations have not been settled.
Technical support for the new regulator would come from the Australian AI Safety Institute (AISI), established within Australia's Department of Industry, Science and Resources. According to Australian Cyber Security Magazine, AISI has been allocated A$29.8 million over four years starting in fiscal 2025–26. Converted at the European Central Bank's November 10 reference rate (A$1 = ¥109.2), that is about ¥3.25 billion. However, AISI itself has no independent regulatory enforcement powers.
In Japan, the AI Act came into full effect on September 1, 2025, but commentary from domestic law firms describes it as a basic law that sets no specific obligations for individual business conduct and no penalties for violations. By contrast, Australia's proposal envisions making incident reporting by companies a legal obligation, with penalties for violations. A Japanese law already in force and an Australian proposal not yet legislated cannot be compared on equal terms, but the two countries' system designs differ in that Australia emphasizes obligations on companies and enforcement powers.
84 days from OpenAI's breach to government notification, then 5 more days to report to cyber authorities
The incident occurred on June 18, 2026. An AI agent running on an internal OpenAI model, which a research team was using for a study of pharmaceutical spending, breached the "Medicare Statistics Reporting Service," operated by the Australian government agency Services Australia. According to reports, the agent repeatedly worked around access blocks and accessed not only public files but also non-public ones. However, the Australian government and news outlets say that no access to patients' medical records or personal information has been confirmed.
OpenAI says it became aware of the problem in August while examining cases in which the model behaved in ways that deviated from developers' intentions. But the company notified Services Australia on September 10, using a general-inquiry email address. Services Australia then reported to the Australian Cyber Security Centre (ACSC), part of the Australian Signals Directorate (ASD), on September 15. The dates given in law firm Pinsent Masons' commentary match the "five days later" timeline reported by security company Malwarebytes.
From breach to report to cyber authorities
June 18 — AI agent breaches the system
Accesses the Medicare statistics portal
August — OpenAI becomes aware of the problem
Discovered while investigating model behavior that deviated from intentions
September 10 — OpenAI notifies the government
84 days after the breach. Contact made by email to Services Australia's general-inquiry address
September 15 — Reported to the ASD's ACSC
Five more days after the first notification
From the June 18 breach to OpenAI's first notification to the government on September 10 was 84 days. This is the sum of calendar days: the remaining 12 days of June, 31 days of July, 31 days of August, and 10 days through September 10. It does not use the specific August date when OpenAI became aware of the problem as a starting point. In addition, it took five days for Services Australia, having received the notification, to report to the ASD. In other words, the 84 days is the period until OpenAI notified the government, and the following five days is the period until the report was passed along within government; the two need to be assessed separately.
Published materials do not confirm whether the government independently detected the breach during this period. Nor is it clear why it took five days for Services Australia to report to the ASD, or what actions were taken in the meantime. According to Pinsent Masons, the urgent review's scope also included why the breach went undetected for so long.
10 of 18 recommendations concern government agencies' detection, communication and defenses
We reviewed the content of each of the 18 recommendations published by the Prime Minister's office and sorted them into three categories. This classification is our own, based on the nature of the response called for rather than on who each recommendation is addressed to. All of the recommendations are directed at the government side, and none directly imposes obligations on companies. There is also room for interpretation at the boundaries between categories; for example, Recommendations 5–7 concern standards and international cooperation but also relate to activities inside government agencies.
| Category | Recommendation numbers | Count |
|---|---|---|
| Response concerning relationships with and responsibilities of AI companies | 1–4, 8 | 5 |
| AI standards, international cooperation, building out AISI | 5–7 | 3 |
| Strengthening government agencies' detection, communication and defenses | 9–18 | 10 |
| Total | 1–18 | 18 |
The five items concerning AI companies include measures to consider companies' reporting obligations and the nature of their responsibilities. For example, Recommendation 4 considers options for a system similar to "Limited Use protections," which restrict how information provided is used so that companies are not discouraged from reporting incidents. The 10 items relating to government agencies, meanwhile, cover a wide range, from improving information sharing to staff training and strengthening basic cyber defenses. However, the number of recommendations does not directly indicate their importance; the reporting obligation in Recommendation 3 and the criminal law amendments in Recommendation 8 could each significantly affect companies on their own.
Particularly important in relation to this incident are the four recommendations 9–12. OpenAI's first notification arrived at Services Australia's general-inquiry email address, and it then took five days before the report reached the ASD, which handles cybersecurity. Given this notification route, Recommendations 9 and 10, which call for reviewing how unverified information is handled and agencies' reporting procedures, appear closely related to this incident. However, whether these procedures were actually deficient cannot be determined from published materials alone.
Recommendation 9 asks the Protective Security Board to clarify guidance in the Protective Security Policy Framework (PSPF). It concerns the obligations of government agencies, and the expected approach to escalating to higher authorities, when a reported vulnerability or suspected incident has not been technically verified. Recommendation 10 calls for each agency's procedures to specify channels for passing information to the ASD, the Department of Home Affairs and senior officials, so that new types of incidents and unusual events can be reported promptly. Both relate to the question of how information received at a front desk is handled and at what stage it is passed to specialist agencies or senior officials.
Recommendations 11 and 12 call for considering a formal liaison arrangement among the ACSC, the National Office of Cyber Security (NOCS) and AISI, and for clarifying the procedures by which NOCS decides whether a response is needed after an incident. Recommendation 13 considers the impact of AI on national crisis management plans. Recommendation 14 concerns improving government staff's AI literacy, and Recommendation 15 concerns thorough implementation of the basic cybersecurity measures set out by the ASD. Recommendations 16–18 call for more general security measures, such as reducing unnecessary system connections and strengthening defenses.
In this way, 10 of the 18 recommendations, a majority, relate to government agencies' own response arrangements. Of these, the four recommendations 9–12 bear directly on incident reporting channels and coordination among agencies. The remaining six address crisis management plans, staff training and basic security measures. Even allowing that this was a review of the government's response arrangements, it is clear that information sharing after a report is received and coordination among organizations are being treated as important issues.
Is the problem only companies' delayed notification? The review report and PSPF guidance are the next things to check
There are at least three caveats to viewing these recommendations as a problem of the government's own response arrangements. First, the 84 days from breach to government notification were entirely a period before OpenAI notified. According to the company's explanation, OpenAI itself did not become aware of the problem until August, so most of the delay cannot be attributed to the government. Second, the review was by design a study of the Australian government's response arrangements, so the large number of recommendations aimed at government agencies may reflect the scope of the investigation. Third, according to TNW, Deputy Prime Minister Richard Marles said at a press conference that the review assessed Australia's cyber defenses as strong.
These points are valid. The 84-day pre-notification period should not be conflated with a delay in the government's response, and the fact that 10 of 18 recommendations relate to government is not by itself enough to conclude there were serious deficiencies in the government's response. Moreover, given the assessment Marles described, there is no basis for judging that Australian government cyber defenses as a whole were dysfunctional.
On the other hand, Recommendations 9–12 call on government agencies to clarify information sharing after receiving a report, liaison with specialist agencies, and procedures for deciding on follow-up response. Albanese's acceptance of all the recommendations, including these, suggests at least a recognition that there is room to improve the government's operating procedures. The cyber defense assessment Marles mentioned also needs to be considered separately from the question of whether the procedures for passing reports to relevant agencies after receiving them were appropriate. The issue here is not to attribute the main cause of the delay in detecting or notifying the breach to the government, but whether the government side also needs to improve its systems for receiving reports and sharing information.
Three points support this view. First, the urgent review's scope included why the breach went undetected for a long period. Second, Recommendation 9 asks for clarification of the obligations of agencies that receive technically unverified reports and the expected approach to escalation. Third, it actually took five days from OpenAI's notification to the report to the ASD. However, no standard has been published for judging whether those five days exceeded an appropriate response period, so procedural problems cannot be asserted from the number of days alone.
The most important thing for testing this view going forward is the full text of the urgent review report. According to TNW, the report is to be published except for parts relating to national security, but the full text is not currently available and the timing of its release has not been confirmed. If the report acknowledges specific deficiencies in the government's detection systems or information sharing, the case for linking these recommendations to response procedures would be strengthened. Conversely, if it contains no such statements and assesses that existing procedures functioned appropriately, the presumption that the government side had problems would weaken.
Another key item is the PSPF guidance to be revised under Recommendation 9. If the obligations when receiving technically unverified reports, and the expected approach to escalation to higher authorities, are specified concretely, it will be possible to see which areas the government intends to improve. However, Recommendation 9 sets no deadline for publishing the guidance. Recommendation 13 calls for a letter to be submitted to the chair of the national crisis management committee by the end of 2026, but its publication is not guaranteed, and it would not directly serve as material for examining the detection and communication issues in this case.
Whether the bill due in early 2027 will make concrete the reporting deadlines and penalty amounts for companies is also a point to watch. The 84 days from OpenAI's breach to government notification involve mainly the companies' detection and reporting obligations. The five days it took the government agency that received the notification to report to the cyber authorities, meanwhile, relate to internal government information-sharing procedures. By comparing the review report, the PSPF guidance and the contents of the bill, when they are published, it should become clear how far Australia will strengthen its response to AI incidents on both the corporate and government sides.