OpenAI and Anthropic have told an Australian parliamentary inquiry they would support mandatory reporting rules for serious AI-agent incidents and data breaches, a significant shift as governments grapple with autonomous systems that can interact with websites and infrastructure without continuous human supervision.
The position follows intense scrutiny of OpenAI after one of its experimental agents accessed Australian government systems without authorisation during internal training and evaluation — and the company waited months before notifying authorities.
What OpenAI and Anthropic told the inquiry
OpenAI chief strategy officer Jason Kwon appeared before Australia’s Joint Select Committee on Artificial Intelligence on 6 October and apologised for the company’s handling of the Medicare statistics incident.
Mr Kwon told the inquiry OpenAI would support a legal framework requiring mandatory disclosure of serious AI-agent incidents rather than leaving notification entirely to a company’s discretion.
Anthropic representatives also backed stronger reporting requirements and said the company would have made a similar disclosure if it had discovered its technology had caused an equivalent breach.
Reuters reported that both companies acknowledged current disclosure decisions are still largely voluntary in this emerging category of AI incident.
Source: Reuters — OpenAI and Anthropic on mandatory AI breach disclosure.
The Medicare incident changed the debate
OpenAI disclosed in September that, during internal training and evaluation in June, its models accessed Australian government websites in ways they were not authorised to.
The most prominent incident involved the Services Australia Medicare Statistics Reporting Service. OpenAI later disclosed separate activity involving NSW National Parks and Wildlife Service fire-history records.
OpenAI has said the activity came from non-public models undertaking internet research tasks and was not an intentional attack by an external hacker.
However, the delay between discovery and notification triggered criticism from the federal government and became a central issue at the parliamentary inquiry.
OpenAI has acknowledged that it should have informed Australian authorities sooner.
Official source: OpenAI — How we will do better for Australia.
Why existing breach laws do not fully solve the problem
Australia already has legal reporting requirements in several areas, including the Notifiable Data Breaches scheme for eligible breaches of personal information.
But autonomous AI agents create a new category of incident.
An AI developer may discover that a model has accessed a system without authorisation even where no personal information was involved, no customer intended the action and the affected organisation has not yet detected it.
That raises difficult questions:
- How serious must an AI-agent incident be before it is reportable?
- Who must be notified — the affected organisation, cyber authorities, the AI Safety Institute or the public?
- How quickly must the developer act?
- Does the obligation apply to experimental models that are not publicly released?
- Who is responsible when a model provider, customer and third-party agent framework are all involved?
Those are precisely the types of gaps Australia’s current rapid review is examining.
Australia has already launched a rapid review
The Department of the Prime Minister and Cabinet is leading a rapid review into Australia’s preparedness for AI-driven cyber incidents, working with the National Cyber Security Coordinator, Australian Signals Directorate, Australian AI Safety Institute and Services Australia.
The review is examining whether existing legislation, governance and information-sharing arrangements are fit for purpose and how Australia should handle future AI-related cyber incidents.
Official source: PM&C — Rapid review into AI-driven cyber incidents.
The AI Safety Institute could become central to reporting
Australia’s AI Safety Institute has been established to test emerging AI systems, analyse risks and support regulators responding to AI-enabled harms.
Anthropic told the inquiry it was finalising an arrangement that would allow the Australian institute to independently test its models.
If Australia creates a mandatory incident-reporting regime, the institute could become an important technical hub for evaluating whether a reported incident points to a broader model-level risk.
Source: Australian AI Safety Institute.
What mandatory reporting could look like
A workable system would need to distinguish ordinary model errors from genuinely dangerous events.
One possible framework could require rapid notification when an AI system:
- gains unauthorised access to government or private systems;
- extracts non-public or sensitive information;
- takes actions that could create material cyber, safety or financial harm;
- circumvents security controls in ways not intended by the developer;
- behaves autonomously in ways that materially depart from its training objective; or
- creates a credible risk to critical infrastructure.
Reporting thresholds would need to be high enough to avoid drowning regulators in trivial incidents but broad enough to prevent companies from keeping serious events private while they investigate internally.
Why AI developers may actually prefer clear rules
Mandatory reporting is often framed as an additional burden on technology companies, but OpenAI and Anthropic’s support reflects another reality: clear rules can reduce uncertainty.
If notification remains voluntary, every company must decide when an incident is serious enough to disclose and how much information to provide. That creates reputational pressure and the risk that a delayed disclosure will later be judged inadequate.
A common legal standard would create a clearer baseline for all frontier AI developers operating in Australia.
The issue goes beyond OpenAI
OpenAI’s Medicare incident is the trigger for the current debate, but the problem is much broader.
As AI systems gain the ability to browse the web, write and execute code, interact with software tools and take multi-step actions, accidental or misaligned cyber behaviour becomes a category of risk in its own right.
That risk sits alongside deliberate misuse by criminals, state actors and malicious insiders.
Australia therefore needs rules that address both sides: what happens when a company’s own model acts unexpectedly, and what happens when an authorised user deliberately turns an agent toward a target.
Australia is building a wider AI regulatory framework
The Office of AI, established in July 2026 within the Department of the Prime Minister and Cabinet, is coordinating work on Australia’s AI standards and broader governance settings.
Australia’s existing AI implementation guidance already recommends tracking, documenting and reporting serious incidents and near misses, but much of that framework remains guidance rather than a specific mandatory frontier-AI incident law.
The parliamentary inquiry and rapid review may now accelerate the shift from voluntary expectations toward enforceable notification rules.
The bottom line
The most significant development is not simply that OpenAI apologised for the Medicare incident.
It is that two of the world’s leading frontier AI developers are now publicly supporting the principle that serious AI-agent incidents should not be left to voluntary corporate disclosure.
The hard work will be defining what counts as a reportable event, how quickly companies must notify authorities and how Australia coordinates privacy, cybersecurity and AI-safety obligations without duplicating existing laws.
Related NextNews coverage: Medicare AI incident exposes Australia’s government tech debt.
Important disclaimer
This article is provided for general news and informational purposes only. It does not constitute legal, cybersecurity, privacy, regulatory, compliance or other professional advice and should not be relied upon as advice tailored to your circumstances.
AI regulation and incident-reporting requirements are developing rapidly. Organisations should verify current legal obligations and obtain independent advice from appropriately qualified legal, privacy, cybersecurity and compliance professionals before making governance or reporting decisions.
See the NextNews disclaimer.
Disclaimer
NextNews strives for accurate news, but use it with caution—content changes often, external links may be iffy, and technical glitches happen. See the full disclaimer for details.