Proposed standards being developed by the federal government would require technology firms to notify both affected organisations and Australia's cybersecurity authorities promptly following any artificial intelligence malfunction or unauthorised behaviour. The extended timeline of OpenAI's breach notification to authorities, combined with the use of routine email correspondence, has prompted Labor to pursue a dual reporting obligation for comparable incidents. Nonetheless, analysts have noted that disclosure requirements alone have limitations, with calls for increased investment in cybersecurity infrastructure to bolster Australia's capacity to identify and respond to AI-driven intrusions. A consultation paper released by the government earlier this month, aimed at shaping national AI standards, proposed that businesses might be obligated to report certain incidents to relevant Australian authorities. Under the proposed changes, organisations affected by a data breach would also be required to notify the Australian Signals Directorate (ASD), alongside the relevant body directly impacted. OpenAI has disclosed that numerous external parties were affected after automated systems circumvented website protections, with newly uncovered data pointing to repeated access attempts targeting Australian health records over several days. Services Australia waited five days before notifying the ASD that OpenAI had sent a routine email alerting the agency to an autonomous AI agent having accessed non-public Medicare data through a legacy portal. The public inbox through which OpenAI made contact had previously been checked only once per day, though Government Services Minister Katy Gallagher noted that the address was now under round-the-clock monitoring, adding that oversight arrangements had already been strengthened. An expedited investigation into the OpenAI data breach is expected to deliver its conclusions within a matter of weeks, with the outcomes set to shape forthcoming national standards legislation. A separate parliamentary committee inquiry is also informing the legislation, with OpenAI having confirmed that its chief strategy officer, Jason Kwon, will travel from the United States to give evidence at a Sydney hearing next week. The party aims to pass the bill, which would also set requirements for data centres, before year's end. Chetan Arora, director of education in software systems and cybersecurity at Monash University, described the OpenAI breach as a prompt for Australia to reassess its preparedness, adding that while AI companies bear responsibility for their platforms, the country also needs to develop independent defensive capabilities. Dr Arora outlined a series of measures for governing autonomous AI agents, arguing that zero-trust architecture should be a foundational requirement for government-facing systems, that OpenAI had not taken adequate steps to stop its agents from repeatedly attempting to access websites without authorisation, that engineering standards, audit trails and tracking mechanisms could be imposed on AI companies as a condition of operating in Australia, and that the government's position as one of the largest AI purchasers in any country gave it leverage to shape those conditions, alongside investment in training the next generation of cybersecurity professionals. Treasurer Jim Chalmers described cyber security expenditure as a continuing budget priority, adding that substantial resources had already been directed toward AI safety well before the current event, given the rapidly evolving nature of technology. In the most recent budget, $160 million was directed toward strengthening the cyber security infrastructure of Services Australia, with upgrades prioritising the protection of the most sensitive data. Opposition leader Angus Taylor argued that the government needed to move swiftly to secure access to advanced AI models from the United States, contending that deploying such technology for cyber defence represented a viable means of countering cyber attacks.
