An OpenAI agent broke into Australia's Medicare portal. Who's the criminal?
Australia's government on November 10 accepted all 18 recommendations of a review into how an OpenAI agent got into a Medicare statistics portal. One asks officials to consider a new crime: an AI company would be liable if its model causes harm and the company failed to take reasonable steps to prevent it. Here is why current law struggles to reach the company, and how reporting deadlines in the US compare.
01A visitor in the Medicare data room
Australians pay for most doctor visits through Medicare, the country's public health insurance. The government publishes Medicare spending data on a statistics portal that researchers and reporters use. On June 18, the portal had a visitor that was not a person. According to news reports, it was an AI agent OpenAI was testing internally, and it got past the public pages into files that were not meant to be seen. The government says the agent got into several government websites, including the Medicare portal.
The agent had reportedly been asked to look up public figures on medicine spending. When it was blocked, it looked for other ways in and reached areas it was not allowed to see. No personal health information is believed to have been accessed. Reports say OpenAI did not notice until August and, on September 10, emailed a general inbox at an Australian government agency. Prime Minister Anthony Albanese made the incident public in September and complained directly to OpenAI CEO Sam Altman.
On November 10, the prime minister's office released 18 recommendations from a rapid review led by the Department of the Prime Minister and Cabinet, working with the National Cyber Security Coordinator, the Australian Signals Directorate and the Australian AI Safety Institute, among others. The government accepted all of them. The full review has not been published.
02Why current law struggles to reach the company
Australia's main unauthorized-access offense, section 478.1 of the Criminal Code, requires proof that a person intentionally caused the access and knew it was unauthorized. Nobody told the agent to break in. Charging a company runs into a similar wall. Under section 12.3, a company's intent is usually shown through its board or a senior manager authorizing or permitting the conduct, or through a corporate culture that encouraged it, or a failure to maintain a culture that required compliance with the law. Conduct an AI system chose on its own does not fit neatly into that chain.
The government's statement does not say whether OpenAI broke the law. Instead, recommendation 8 asks the Attorney-General's Department, working with the Australian Federal Police and the Home Affairs department, to consider changing the criminal law. It names two options: criminal penalties for egregious breaches of AI safety rules, and a standalone offense that would make a company liable when an AI model it built causes harm and it failed to take reasonable steps to prevent that harm.
03'Failure to prevent' is not new in Australia
Australia already uses this kind of offense. Since September 8, 2024, section 70.5A of the Criminal Code has made a company liable when someone acting for it bribes a foreign official. There is one defense: the company must prove it had adequate procedures to prevent bribery. Britain built the model first, in section 7 of its Bribery Act, in force since July 2011, and extended it to fraud on September 1, 2025.
Applied to AI, the burden flips. Today, prosecutors have to show who intended what. Under a failure-to-prevent offense, the company would have to show it took reasonable steps. Workplace safety law offers a familiar parallel: after an accident, the employer is asked whether it took reasonable precautions. For now, though, this is only a recommendation to study the idea. There is no bill and no proposed penalty.
0484 days, and what US law would require
It took 84 days from the access on June 18 to the email on September 10. In California, where OpenAI is based, a state law in force since January 1, 2026, known as SB 53, requires frontier AI developers to report a "critical safety incident" to the state's Office of Emergency Services within 15 days of discovering it. If an incident poses an imminent risk of death or serious injury, the developer has 24 hours to alert an appropriate authority. California's clock, though, starts when a developer discovers an incident, and reports say OpenAI found out only in August.
Whether this case would count as a critical safety incident under that law is an open question. Even if it did, the report would go to a California agency. Nothing in the law requires a developer to tell a foreign government whose systems were hit. That gap is why recommendation 3 calls for mandatory, time-bound reporting to Australia itself. The government plans to propose a new AI safety regulator, which would require frontier AI companies to maintain security controls, manage serious risks, allow independent evaluations of their models, report incidents rapidly and publish safety frameworks, with significant penalties for those that do not comply.
05What comes next
The new duties are meant to go into Australia's AI Standards legislation, but the government says details will come after more consultation. The criminal-law options go to the Attorney-General's Department first. The rules would apply to every frontier AI company that wants to operate in Australia, including US firms such as OpenAI.
South Korea, by comparison, put its AI Basic Act into force on January 22. It sets administrative fines for breaches but has no offense that holds a company criminally liable for harm its AI causes.
