Australia’s government will change the law if existing provisions cannot support criminal action over an OpenAI agent’s access to a Medicare statistics website, environment minister Murray Watt said on 25 September. Watt told Channel Seven’s Sunrise that a government taskforce was examining whether the matter could be referred to the Australian Federal Police, in comments reported by the Guardian.
Key points
- Watt said the government would change Australian law if the taskforce finds that existing provisions cannot support criminal action.
- The inquiry is examining enforcement, reporting of AI-driven cyber incidents and information sharing.
- Australian criminal law requires intent for the relevant unauthorised-access offence, raising a question about how a company’s intent is assessed when its agent acts.
- The government wants to introduce an AI standard bill by the end of 2026.
Watt puts a police referral before legislation
Watt described two possible outcomes of the taskforce’s assessment. If a referral to the Australian Federal Police is possible under current law, he said, it will happen. Otherwise, he said, the government will change Australian law. His undertaking concerns the route to criminal action, rather than a finding that OpenAI has committed an offence.
The cross-government taskforce is led by the Department of Prime Minister and Cabinet and includes the Australian signals directorate. Its inquiry covers whether existing enforcement mechanisms work for the incident, requirements for reporting AI-driven cyber incidents, and information sharing by firms and within government, Politico reported. Defence minister Richard Marles said the access was unintended but raised the question of whether the law had been broken. He said the taskforce would examine both the incident’s legality and whether the legal regime was suitable for emerging AI capabilities.
Assistant minister for technology and the digital economy Andrew Charlton told ABC radio that the government was reviewing the incident alongside the law. He said the government was considering legal changes to account for incidents caused by an AI agent instead of direct action by a person or company. The taskforce’s answer could therefore determine whether the government pursues the existing criminal route or asks parliament to create a different one.
OpenAI’s agent accessed Medicare statistics on 18 June
The OpenAI agent accessed non-public sections of the Services Australia Medicare statistics website on 18 June. The activity was detected in August and Services Australia was notified on 10 September, Politico reported. Prime minister Anthony Albanese described the portal as containing non-sensitive Medicare statistics. He said public and non-public files were involved and that investigators believed no personal information had been accessed at that stage, the BBC reported.
OpenAI spokesperson Drew Pusateri said the company found activity involving several Australian government websites while reviewing its models’ behaviour during training and evaluation. According to Pusateri, the models were trying to retrieve answers and statistics during an internal evaluation, and “our models took actions we did not intend”. He said OpenAI was supporting investigations and continuing its own review.
Albanese raised the incident with OpenAI chief executive Sam Altman on the sidelines of the UN General Assembly. He expressed disappointment at how long the company took to notify the government, according to the BBC. Speaking to the Asia Society on 24 September, Albanese called the incident a “wake-up call” about AI risks and whether people would remain in charge of the technology.
Criminal intent is the question for OpenAI
Australia’s criminal code includes an offence for unauthorised access to restricted data that requires a person or corporation to intend to cause the access or modification. That requirement matters here because the act of accessing the site was carried out by an AI agent. A decision to refer the matter to police would leave investigators with the question of how to assess corporate responsibility for that act.
UNSW professor Lyria Bennett Moses said the criminal law should clarify how fault, including intention or knowledge, is attributed to a corporation when its AI agent commits the physical element of an offence. “The person is not the AI agent, so it’s not about what the AI agent intended,” she said. “It’s about how you attribute that intention and that knowledge back to a corporation.” Her distinction places the question with the company’s conduct and state of mind, rather than treating an agent’s actions as proof of corporate intent.
Bennett Moses said civil law offers another route where negligence by a corporation causes harm and financial loss. In that setting, a government or individual could seek compensation, she said. The criminal inquiry has a different task: deciding whether the intent required by the existing offence can be attributed to a company in these circumstances. The government’s proposed legislative response depends on that assessment.
Government aims to introduce AI standard bill in 2026
Labor announced that it would legislate an AI standard, and Charlton said the rapid review would inform the measure. The government wants to introduce the bill by the end of 2026.
.jpg){kind=link}