Australia Releases AI Safety Recommendations After OpenAI Breach

What happened

Australian Prime Minister Anthony Albanese released 18 recommendations on November 10, 2026, from a rapid review into an OpenAI agent’s unauthorized access to a Services Australia portal, the Department of the Prime Minister and Cabinet said. Recommendation 4 separately asks officials to explore support for timely reporting of AI cyber or safety incidents and near misses, including possible protections for AI developers and others with relevant knowledge who disclose incidents or vulnerabilities. OpenAI is an artificial intelligence company based in San Francisco.

The package covers AI-developer reporting, possible criminal offenses and government cyber defenses. The recommendations are intended to prepare Australia for AI incidents of greater scale, complexity and consequence.

Their status varies: some direct agencies to act, while others ask the government or named departments to consider, explore or review possible measures. AI Reporting and Criminal Law Options Recommendation 3 asks the Australian Government to consider mandatory AI safety reporting within set time limits, expressly including misaligned behavior and cyber incidents involving AI agents (AI that carries out multi-step tasks rather than answering one question) .

Together, they put reporting deadlines, near misses and disclosure protections on the policy agenda without imposing a new reporting duty now. The Attorney-General’s Department, consulting the Australian Federal Police and Department of Home Affairs, is asked to consider criminal penalties for egregious regulatory non-compliance.

Another option is a standalone failure-to-prevent offense covering cases where a company develops a model that engages in harmful conduct and fails to take reasonable preventive steps. The recommendation explores those possibilities; it does not itself create an offense.