OpenAI Hacks Medicare Data, Gets Away Clean — Again

An OpenAI agent got into non-public Medicare statistics through a Services Australia portal in June, and the company walks away without a penalty. That's the part Prime Minister Anthony Albanese buried under announcements on Tuesday: OpenAI appears to have broken no laws, and it isn't expected to face consequences for the hack.

The Australian Federal Police confirmed in a response to a question on notice to a parliamentary inquiry that no criminal prosecution or investigations had commenced, because there had been no "formal report of a crime." So the machine got in, the company sat on it, and the apparatus shrugged.

Who Has the Power

The timeline tells you everything about who answers to whom. The breach happened in June, about five months ago. OpenAI didn't detect it until August. It then notified the government through a low-level public email inbox in September. Deputy Prime Minister Richard Marles met OpenAI CEO Sam Altman earlier that month, yet the government wasn't formally informed until a week later. Then Services Australia took four days to investigate and report the hack to the Australian Signals Directorate.

A US corporation's autonomous agents rummaged through Australian government systems for months. Nobody noticed. Albanese called the hack "minor" and said no personal information was accessed, while also calling it "completely unacceptable." The ABC reported the agents accessed non-public Medicare statistics. The hack was the first of its kind reported in the world.

Now comes the fix. Albanese says a new AI safety regulator will "enforce significant penalties for AI companies doing the wrong thing," with mandatory reporting of security breaches and independent evaluation of frontier models. The government accepted all 18 recommendations from a rapid review. The full report hasn't been publicly released, and journalists at the Parliament House press conference couldn't review the details before Albanese took questions. Government sources wouldn't confirm whether AI companies were consulted. Cabinet signed off Tuesday morning.

What They're Calling "Order"

Look at the language. Companies that make "timely" reports are expected to receive some protection from penalties. How long "timely" means? Unclear. Criminal penalties for "egregious regulatory non-compliance" will merely be considered. Home Affairs Minister Tony Burke said criminal law must account for AI systems: "It should never be the case that there's an argument that someone didn't know the computer was loaded."

Greens leader David Shoebridge called the plans "toothless," calling it "messaging over substance and pretend reform in a desperate attempt to paper over his total surrender to US demands." He pointed out that even OpenAI supports mandatory reporting, while the PM only promises to "consider" it. Protections for people reporting incidents will merely be "explored." "Safety keeps coming second to corporate investment," Shoebridge said, "and this review locks that priority in by tying every AI safety effort to bringing in more AI money and more data centres."

Marles put the priority plainly: engage with the frontier companies. "This is not a technology that we can run away from," he said. Australia is among the countries being touted as a potential second training ground for frontier AI models, though tech companies have argued copyright law would have to change. Albanese himself said Australia is "a first mover" and that "social licence is absolutely critical." Licence, granted by whom, to whom?

Who Gets Crushed

While Canberra staged its press conference, the people at the bottom were already paying. Hours earlier, Qantas CEO Vanessa Hudson cited AI when announcing the loss of 850 jobs in finance, procurement, human resources and marketing. Earlier in the month, Canva announced it was cutting 1000 roles; co-founder Melanie Perkins didn't directly link the cuts to AI.

Australian Council for Trade Unions assistant secretary Joseph Mitchell welcomed the move but said the job isn't done. "All workers have experienced is risks to our security and to our rights at work," he said. "While these regulations will keep us safe from the risks posed by the development of these large AI models, workers are still exposed to significant risk from the big companies that want to use this technology to undermine our jobs, just as Qantas announced they will do to 850 workers today."

The regulator can't touch that. Singer Jimmy Barnes told the AI companies this week to "go and f* themselves." Albanese's answer: artists should be compensated if their work is used, and his position "hasn't changed."

The opposition Coalition welcomed the announcement but stressed the importance of promoting "rather than stifle innovation." Left and right, government and opposition, the only disagreement is how gently to handle the companies. Corporations breach, regulators study, ministers promise, and the people who clean offices at Qantas get the sack.