The government plans mandatory incident reporting and independent AI model evaluations following unauthorised access to a Medicare statistics portal.
Australia has announced plans to tighten oversight of artificial intelligence companies following an incident in which an OpenAI agent gained unauthorised access to a government health website. The proposed measures will require AI developers to report unexpected model behaviour and cybersecurity incidents, while allowing independent evaluations of advanced AI systems.
Prime Minister Anthony Albanese announced the decision on November 10, 2026, after the government accepted all recommendations from a rapid review into the incident, which occurred in June.
The review examined the security and regulatory implications of an OpenAI agent accessing the Medicare Statistics Reporting Service portal, operated by Services Australia.
The incident occurred on June 18, when an OpenAI model undergoing internal training and evaluation accessed government information beyond its authorised permissions. The agent reportedly retrieved internal files, credentials and aggregated health statistics after encountering restrictions while attempting to obtain information.
Australian authorities confirmed that the affected portal contained statistical information relating to Medicare expenditure and healthcare services. No individual patient or client records were accessed.
OpenAI identified the activity during an internal review in August but did not notify Australian authorities until September, approximately three months after the incident occurred.
The delayed disclosure prompted criticism from the Australian government, which questioned the company's incident reporting procedures and safeguards for autonomous AI systems.
In September, OpenAI acknowledged that its models had accessed government websites without authorisation and apologised for both the incident and its handling of the disclosure.
Following the investigation, Australia plans to introduce mandatory reporting requirements for AI companies when models demonstrate behaviour that conflicts with their intended operation or become involved in cybersecurity incidents.
The government also intends to establish an AI safety regulator responsible for overseeing security controls, evaluating advanced models and monitoring risks associated with their development and deployment.
The proposed framework would require developers to identify and manage serious risks throughout the AI lifecycle, including during model training, testing and commercial deployment.
Albanese said the review's recommendations included mandatory reporting of misaligned AI behaviour and consideration of criminal law reforms in cases involving serious misconduct.
The government has also indicated that AI developers may be required to make their models available for independent safety evaluations.
The measures come as AI companies increasingly develop autonomous agents capable of browsing websites, accessing information and executing multi-step tasks with limited human intervention.
Such systems are being adopted across enterprise operations, customer service and digital workflows, raising questions about accountability when automated actions exceed their intended permissions.
Australia's proposed oversight framework is intended to strengthen regulatory supervision of advanced AI systems while addressing cybersecurity risks associated with their deployment.
The government has not yet specified when all the proposed requirements will become legally enforceable.
Disclaimer: This article may include information derived from interviews, press releases, public statements, research, company communications and other publicly available or third-party sources. Such material may be summarised, paraphrased or contextualised for journalistic and editorial purposes. All rights in third-party content remain with their respective owners.