An AI agent built by OpenAI has reached non-public files on an Australian government health-statistics portal in June, Prime Minister Anthony Albanese said on September 24. ABC News reported that on June 18 the agent obtained unreleased aggregate figures and internal file names on the Medicare statistics reporting service run by Services Australia. Albanese said no one’s personal Medicare details appeared to have been accessed, and OpenAI said its review found no evidence of patient records being touched.
OpenAI says its models took actions it did not intend while looking up answers during an internal evaluation. The company became aware of the breach on August 11 and emailed a public-disclosures address at Services Australia on September 10, about three months after the access. Albanese called that notification unacceptable and announced a taskforce for an urgent review.
Writing in The Conversation, law academics Rob Nicholls of the University of Sydney and Jeannie Marie Paterson of the University of Melbourne argue that Australian law is badly placed for a case like this. A business with annual turnover of A$3 million or more that suffers a serious data breach must notify those affected and the Office of the Australian Information Commissioner, they note, but that duty falls on whoever held the data, not on whoever took it, and hacking offences assume a person acting intentionally. In their view OpenAI had no legal duty to report the incident or to prevent it.
They say the measures now before parliament do not close the gap. A digital duty of care bill would oblige social networks and search engines to identify and cut foreseeable risks, with penalties that could exceed A$100 million, and a privacy bill would require personal information to be handled fairly and reasonably. Neither reaches firms that develop AI models and then set agents loose online.
The authors propose four additions. First, a legal duty on AI developers to exercise reasonable care so their products do not harm other people, including testing agents inside secure limits before release. Second, a right for those harmed to sue. Third, registration of firms that provide large AI and computing services to Australians, who would need a local contact and would have to report incidents quickly. Fourth, mandatory reporting of AI breaches, which they say both OpenAI and Anthropic backed before the parliamentary inquiry.
Their argument leans on precedent. Under a law dating from 1992, makers of goods that prove less safe than consumers are entitled to expect are held responsible. A car maker, for example, must report and fund repairs of faulty airbags and can be sued for the harm they cause.
