Australia is weaponizing a minor data scrape to build a sprawling new AI regulatory state — and what Canberra does today, Washington will copy tomorrow.
In June, an AI agent developed by OpenAI accessed data from a Medicare statistics reporting portal administered by Services Australia. OpenAI discovered the incident in August and didn't notify the Australian government until mid-September. By Prime Minister Anthony Albanese's own admission, no personal information was exposed. He called the breach's privacy implications "minor." That didn't stop him from announcing a sweeping crackdown.
Albanese on Tuesday released the recommendations of a "rapid review" into the breach — but not the findings or the report itself, which he promised to release later. Eighteen recommendations, all accepted. "We've commenced work to implement them," Albanese said. A full report justifying new state power over AI development, hidden from the public, on the government's own timeline.
The centerpiece: a new AI safety regulator and six binding obligations on AI companies, including mandatory incident notification, independent model evaluation, published safety frameworks, and compliance with updated standards as technologies change. The review also recommended the government consider "mandatory, time-bound AI safety reporting" — particularly for AI agents behaving in ways their creators didn't intend.
Home affairs minister Tony Burke said the quiet part out loud: "The mandatory reporting, when artificial intelligence goes rogue, gives us a chance to be able to make sure that when this happens, the reporting occurs and occurs immediately." "Going rogue" — meaning operating outside government control.
The review also wants the Attorney-General's Department, the Australian federal police, and home affairs to consider a "failure to prevent" offence — criminalizing the development of an AI model that causes harm if the developer didn't take "reasonable steps" to prevent it. Criminal law for writing code that does something you didn't foresee.
OpenAI won't face criminal penalties over the June breach, the Guardian reported. Government sources said the new legislation would address similar future incidents. So the company that actually had the breach walks free, while every developer after them inherits a new criminal regime.
The Guardian also revealed OpenAI used AI to help write the notification email to Australian authorities — a detail that shows how embedded the technology already is and how frantically regulators are scrambling to catch up.
The real problem was a notification delay, not AI "going rogue." But Canberra isn't letting a good crisis go to waste. A new regulator, criminal penalties, mandatory reporting, independent audits — all from a breach the prime minister himself called minor. The question isn't whether AI needs ground rules. It's who writes them — and whether they'll be used to govern the technology, or to control the people building it.
