The Australian government has released the results of a Rapid Review into the recent OpenAI hacking incident that saw an AI agent access Medicare data without authorisation, alongside accessing several other government websites.
OpenAI itself won’t face any criminal penalties, but similar future incidents could lead to criminal charges, according to one of the 18 recommendations.
Recommendation Eight calls on the Attorney-General’s Department, the Australian Federal Police, and the Department of Home Affairs to consider “options to reform the criminal law to improve AI safety”.
This could include “the application of criminal penalties for egregious regulatory non-compliance”, as well as introducing a ‘failure to prevent’ offence that applies where models engage in “harmful conduct” or when a company “fails to take reasonable steps to prevent that harm”.
“It should never be the case that there's an argument that someone didn't know the computer was loaded,” Tony Burke, Australia’s Minister for Home Affairs And Cybersecurity, told reporters in Canberra on Tuesday.
“We need to make sure that the criminal law is up to date for how this new technology is able to act. And finally, we need to also look at the equivalent to limited use provisions.
“In the Cybersecurity Act, we've got these rules where when something goes wrong, the company can, without any risk to themselves, provide all the technical information as to what's happened with the cyber attack to government and know that we will only use it for that purpose. We need to look at having a similar arrangement where AI companies, if there is a vulnerability we need to be aware of, are able to provide that under similar systems.”
The Rapid Review also recommends the Australian government deepen engagement with frontier AI developers, including OpenAI, through technical collaboration, personnel exchanges and incentives for companies to establish research and safety operations in Australia. It also calls for mandatory, time-bound reporting of AI safety and cyber incidents, protections for vulnerability disclosures, and stronger international cooperation on AI standards and safeguards.
On cyber security, it recommends clearer incident escalation procedures, stronger information sharing between the Australian Signals Directorate's Australian Cyber Security Centre, the National Office of Cyber Security, and the AI Safety Institute, and better coordination of national crisis responses to AI-driven incidents.
Other recommendations include improving AI literacy across government, reinforcing baseline cyber security practices, reducing the government's internet-connected digital footprint, strengthening protections for critical government systems, and exploring the responsible use of AI-enabled tools for threat detection, security monitoring and incident response.
Prime Minister Anthony Albanese said the government accepts all 18 recommendations.
“AI offers Australia and the world generational opportunities if we seize and shape them properly, and that is exactly what we're doing here,” Albanese said.
“We want to take advantage while mitigating the risks, which are there. We have the opportunity to position Australia as a global leader in this space and to influence how the world tackles this challenge, but also this opportunity.”
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
