Australia is looking to impose a dual notification requirement under tougher new standards enforced after OpenAI’s breach of a Medicare website.<\/p>\n
Systems of Government Significance will be prioritised and a review is due by the end of the year.<\/p>\n
Less vital systems will be assessed by the end of March next year.<\/p>\n
Acting Home Affairs Minister Richard Marles stressed the importance of constantly reviewing the systems in a rapidly changing environment.<\/p>\n
“AI is changing the environment in which we operate at extraordinary speed. Government systems need to keep up,” he said in a statement.<\/p>\n
“We can’t wait for an old system to fail before replacing it. We need to identify vulnerabilities and deal with them before they can be exploited.”<\/p>\n
![\"A](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/09\/12d66d3b3569f83421913ec6b20f98f7.jpeg\")
<\/p>\n
Richard Marles says government systems need to “keep up” with the risks posed by emerging technology. (ABC News: Ian Cutmore)<\/p>\n
The breach has sharpened Labor’s plans to impose reporting requirements on artificial intelligence companies.<\/p>\n
Australia is set to introduce legislation for national standards to put “guardrails on AI”, which would include mandatory standards for data centres, before the end of the year.<\/p>\n
A rapid review into the OpenAI breach is due to conclude within weeks and the findings are expected to inform the national standards.<\/p>\n
New details about OpenAI government disclosure<\/p>\n
OpenAI has faced scrutiny over the two-month delay in informing the government about the Services Australia breach, as well the nature of the disclosure.<\/p>\n
The website targeted was a legacy system that has since been shut down, with the data moved to a more secure address.<\/p>\n
A copy of the letter obtained by ABC reveals the framing to the government, which was notified of “security vulnerability identified” during a review of the agent’s activity.<\/p>\n
“An OpenAI model identified a way to make the server carry out instructions sent through the public reporting interface, without a private account or password,” the notification said.<\/p>\n
“It was able to access this to read portions of internal program files and settings, obtain a list of files, and create and read back a small test file on the server.”<\/p>\n
OpenAI has since admitted the agent took actions the company “did not intend” during the incident.<\/p>\n