Australia's government has accepted all 18 recommendations of a review into an OpenAI agent incident at a Medicare statistics website, and it plans to write mandatory safety rules for frontier AI companies into law. One recommendation asks officials to consider new criminal law, including a possible "failure to prevent" offence. None of this is law yet.
Prime Minister Anthony Albanese released the recommendations on Tuesday, Nov. 10, 2026. His media release says the review was commissioned in September "after OpenAI informed the Australian Government that a rogue AI agent had infiltrated government websites, including the Medicare Statistics Reporting Service Portal." It adds: "The Government accepts the recommendations and has commenced work to implement them."
What the review recommends
The Department of Prime Minister and Cabinet ran the review with the National Cyber Security Coordinator, the Office of AI, the Australian Signals Directorate, the Australian AI Safety Institute and Services Australia, the release says. The department's recommendations page lists all 18.
For AI companies, three stand out:
- Reporting. Recommendation 3 asks the government to "consider mandatory, time-bound AI safety reporting, including but not limited to misaligned behaviour or agentic cyber incidents."
- Protections for reporting. Recommendation 4 asks it to explore options to support timely reporting of AI incidents, for example protections for disclosures from AI developers, "analogous to existing Limited Use protections."
- Engagement. Recommendation 1 asks the government to engage with OpenAI's Australian Taskforce and to explore secondments and technical placements with frontier AI firms.
Most of the rest are aimed at government itself. They cover how agencies escalate suspected cyber incidents, information sharing between cyber agencies and the AI Safety Institute, AI literacy for staff, basic cyber security practice, and shrinking the government's internet-connected systems.
The planned frontier AI rules
A second release the same day, New Australian AI safety and security protections, says mandatory protections "will be legislated through the AI Standards and apply to all frontier AI companies that wish to operate in Australia."
The government "will propose these protections be enforced by a new targeted regulator for AI safety," the release says, and that regulator would work with the Australian AI Safety Institute. "The regulator would be able to enforce significant penalties," it says. The release gives no penalty amounts.
The joint release lists six requirements. Companies would be required to:
- Maintain security controls across all stages of development and deployment
- Identify and manage serious risks associated with their models
- Allow independent evaluation of their models
- Provide mandatory notification of incidents to the Australian Government rapidly
- Maintain and publish safety and security frameworks to ensure good governance, risk management and transparency
- Respond to updated standards and rules as technologies change
The criminal law question
Recommendation 8 is the one that drew headlines. It asks the Attorney-General's Department, in consultation with the Australian Federal Police, Home Affairs and other agencies, to "consider options to reform the criminal law to improve AI safety." It lists two options to explore:
- "the application of criminal penalties for egregious regulatory non-compliance"
- "a standalone 'failure to prevent' offence which would criminalise instances where the company is responsible for developing an AI model that engages in harmful conduct, and the company fails to take reasonable steps to prevent that harm"
The wording is "consider" and "exploring." It does not create an offence.
At the press conference, Home Affairs Minister Tony Burke said: "It should never be the case that there's an argument that someone didn't know the computer was loaded."
ABC News reported that Australia "could become the first country" to prosecute AI companies for failing to take reasonable steps to prevent harmful conduct by their models.
What has been reported about the OpenAI incident
Albanese said at the press conference that "no one's personal details, for example, were obtained." He said "the implications of this in fact were minor in terms of direct implications, but that doesn't mean that it wasn't a serious issue." He said the government "will release the report" and that "national security interests are defended in that."
The BBC reported that OpenAI said it only learnt of the breach in August while reviewing "misaligned model activity," and emailed a general inbox of an Australian government agency on Sept. 10. The Age reported that the incident took place in June and that "OpenAI is not expected to face consequences for the hack."
ABC News reported that the Australian Federal Police told a parliamentary inquiry, in a letter released the week before, that it had received no formal report of a crime and had begun no criminal investigation or prosecution over the incident. ABC also reported that Albanese did not answer questions about whether he believed OpenAI had committed a crime. An OpenAI spokesperson told the ABC that the company was reviewing the government's proposals.
Why it matters
Earlier this month, the EU AI Office asked OpenAI and Anthropic for more detail on AI agent incidents. Australia's plan adds more formal tools: a new regulator, mandatory incident notice, independent model evaluations, and a review of the criminal law. In the US, New York's proposed RAISE Act 2.0 is another bill that would add duties for frontier developers.
What happens next
Nothing announced on Nov. 10 is law. The joint release says "Further details of the legislation will become available in due course." The criminal law options are at the "consider" stage with the Attorney-General's Department. The full review report has not been published yet; only the recommendations are out.
Sources
- Prime Minister of Australia: Strengthening Australia against AI-driven cyber incidents (Nov. 10, 2026)
- Prime Minister of Australia: New Australian AI safety and security protections (Nov. 10, 2026)
- PM&C: Rapid Review recommendations
- PM Transcripts: Press conference, Parliament House, Canberra (transcript 47730)
- ABC News: Australia considers world-first criminal charges for AI companies that fail to prevent harm
- BBC: Australia considers criminal penalties for rogue AI in wake of OpenAI hack
- The Age: Criminal penalties for big tech, but OpenAI to avoid fines after Medicare hack
