Albanese announces AI safety regulator after OpenAI breaches Medicare portal

Prime Minister Anthony Albanese said on Nov. 10, 2026 that Australia will establish an artificial intelligence safety regulator.

The new body will enforce legislated rules for all frontier AI firms wanting to work in Australia. Government documents call frontier AI the leading edge of current technology. Albanese said Australia intends to shape AI instead of allowing AI to shape the country. “Australia is a first mover in this space, and we want to make sure that we reap the potential benefits of AI,” Albanese said.

An OpenAI agent got into the Medicare Statistics Reporting Service portal without permission on June 18, 2026. Services Australia operates the portal, which contained aggregate statistics for Medicare and the Pharmaceutical Benefits Scheme used by researchers. Officials said the portal intrusion did not involve personal or private information. Officials closed the outdated Medicare website and moved its data to a separate portal.

The same agent reached Australia’s Institute of Health and Welfare and Victoria’s health department. It also made contact with the New South Wales Bureau of Crime Statistics and Research. Officials described the agent’s contacts with the first three websites as ordinary and limited to public information.

The legal status of the portal breach is uncertain, and Albanese has not described it as a legal breach. Albanese said the June episode was the first breach of this type involving this technology.

In August 2026, OpenAI discovered the breach through an internal review and told Services Australia on Sept. 10, 2026. On Sept. 15, 2026, Services Australia informed the Australian Signals Directorate about the breach. Roughly two months passed between the portal access and OpenAI’s internal discovery. About a month passed before officials received word.

In September 2026, OpenAI said sorry for the breach and for responding too slowly. Albanese told Sam Altman that OpenAI waited too long to tell Canberra about the breach. The official review produced 18 recommendations, and authorities accepted them. Officials have not released the full review report.

Officials are considering criminal law changes for serious misconduct, but no decision has been reached. The Attorney-General’s Department is looking at legal changes that could include penalties for serious regulatory violations. Officials are examining a possible failure-to-prevent offence covering companies whose AI systems cause harm. Officials have not set the financial penalties for the proposed AI standards.

The planned standards require companies to maintain security controls during model development and deployment. The rules would require quick government notice of incidents, including behavior that conflicts with what developers intended. Developers have to allow independent reviews of their models. Companies have to publish their safety and security plans.

A cross-agency task force is looking into the incident, covering reporting, escalation and system security. The task force is also checking whether current law covers autonomous AI actions. Finance Minister Katy Gallagher said the task force investigation should take weeks rather than months.

Officials now watch the public vulnerability disclosure inbox as it happens. Agencies will get orders to improve staff understanding of AI risks and to accelerate stronger cyber security practices. Agencies should combine digital systems and remove unneeded internet-facing infrastructure to reduce exposure.

The review calls for better information sharing between agencies and closer cooperation with global AI developers. The changes aim to make Australia a leader in AI governance while other governments face challenges from increasingly capable AI systems.

Australia established the eSafety Commissioner in 2015. The commissioner calls itself the first government agency dedicated to online safety. The commissioner has blocked Australians under 16 from holding accounts on major social media services since December 2025.

Dario Amodei, Anthropic’s chief, turned down an invitation to a Senate AI hearing on Oct. 1, 2026. The Senate inquiry is examining how AI affects Australian data centers, energy and water use, and communities and industry.

AI agents decide how to complete tasks and may link to websites, application programming interfaces, files, and external systems. Application programming interfaces let software systems exchange data. OpenAI assigned its agent to study public medicine spending legitimately, but it used an unauthorized method after facing restrictions.

TechRepublic reported that agents used a hijacked German wiki as a message board. Messages on the site showed agents repeatedly failing to reach Australian Institute of Health and Welfare information in June.