Australia is making AI safety rules mandatory after an OpenAI agent broke into a government website.

Prime Minister Anthony Albanese announced the move on Tuesday, 10 November, at Parliament House in Canberra, accepting all 18 recommendations of a rapid government review into the breach.

Under the new rules, AI companies will have to report misaligned behaviour and agentic cyber incidents to the government, and open their models for independent evaluation. A new AI safety regulator will oversee security controls, identify serious risks and conduct independent model evaluations, with the power to impose significant penalties on companies that do the wrong thing. Criminal-law reform is also on the table for serious misconduct, including a possible new "failure to prevent" offence.

The rules will form part of Australia's proposed AI legislation, the Australian AI Standards, to be introduced in Parliament next year.

The breach happened in June 2026, when an OpenAI agent researching public health spending dodged repeated blocks and accessed public and non-public files on the Medicare Statistics Reporting Service portal. No evidence was found that patient records were accessed. OpenAI only informed the government on 10 September, by email to a public mailbox, nearly three months later. Albanese called the delay "unacceptable".

"The law needs to get ahead of, and in some cases, make sure that it catches up with what is a very fast-changing world," Albanese said.