Australia considers criminal penalties for rogue AI in wake of OpenAI hack

Australia plans to create a new AI safety regulator and has flagged criminal penalties for tech companies who do not comply, months after an OpenAI hack.

In September, Australia's Prime Minister Anthony Albanese revealed that a rogue OpenAI agent had "infiltrated" a government health website and other systems, and criticised the company for taking months to tell them about the hack.

On Tuesday, he released the 18 recommendations made after a "rapid review" into the breaches including new safety and security standards for AI companies such as mandatory reporting of hacks.

AI brings opportunities, he said, but Australia must prepare for the "new risks" from this "rapidly advancing technology".

"The law needs to get ahead of and, in some cases, make sure that it catches up with, what is a very fast changing world," Albanese said.

One of the recommendations suggests changes to criminal law to have a standalone "failure to prevent" offence.

This would criminalise instances where a company develops "an AI model that engages in harmful conduct" and "fails to take reasonable steps to prevent that harm".

The review also recommended "mandatory, time-bound AI safety reporting" of hacks.

This point addresses what Albanese had earlier called his "disappointment" in the months-long delay for OpenAI to tell his government about the breach.

In June, a statistics portal containing "non-sensitive" data from Australia's universal healthcare scheme Medicare was hacked by a rogue OpenAI agent.

OpenAI said it only learnt of the breach in August while reviewing "misaligned model activity" and emailed a general inbox of an Australian government agency on 10 September.

It took several more days before the email was escalated to Australia's cybersecurity centre, with a message then sent to a government minister ahead of the prime minister being told.

Albanese said he spoke to OpenAI boss Sam Altman and raised "Australia's extreme concern about this incident" and with Altman acknowledging there were "issues with protocols" at OpenAI.

Days after the hacks were revealed, OpenAI delayed its rollout of a new AI model, citing safety concerns.