When you get sick, Medicare exists to take care of you. It sits at the centre of a health system that our prime minister rightly calls the envy of the world. Itās one of the few institutions nearly every Australian still trusts. So when an AI company threatens this system, it couldnāt be more serious.
We are at the UN general assembly this week and the OpenAI hack has put Australia in the spotlight during an expanding cybersecurity crisis. World leaders are calling for stronger oversight of frontier models. We know Medicare must be secure or our doctors and hospitals cannot do their jobs. But this breach is also a test of something larger: whether the Australian government can hold a US tech giant to account when its technology goes rogue. If Australia canāt protect our community ā if it canāt enforce our laws and prevent such attacks happening again ā then we are entering a terrifying period.
Letās start with what happened. OpenAI is one of the most powerful companies on Earth. Its AI agents were let loose with a pretty mundane task: to gather information on public health systems around the world. When those agents couldnāt immediately get what they wanted from public websites in Australia, they did not stop. They broke in, hacking into a secure database to get the information they were told to find. To be clear: hacking is unlawful. Human hackers face serious consequences, and so must AI companies. There is no excuse for what happened.
This was a double failure. OpenAI knows that AI agents can act in unexpected ways and even ācheatā to complete tasks. It failed to take necessary precautions and instead let its AI agents run without proper oversight. Carelessly deploying risky technology can cause serious consequences.
What happened next, or rather what didnāt, made it worse. OpenAI took far too long to notify the federal government of this breach and they chose the least effective method.
OpenAI employs some of the most experienced experts in the world, they have an Australian office, and they have a direct line to the highest levels of the Australian government. Yet it seems no one picked up the phone to a senior government official. Instead, they waited two months before they sent an email to a generic inbox. OpenAIās failure to act with urgency slowed down Australiaās response to a critical breach.
Anthony Albanese has announced an investigation. Rightly so. But we also need to reflect on the broader crisis we face.
Too often, itās in retrospect that we realise when a red line has been crossed. But this is a major red line ā an attack on our health system ā and it must galvanise us into serious action.
Two paths are open to us.
The easy path is to do the absolute minimum without upsetting the tech companies whose dollars and datacentres the Australian government is seeking to attract. That path involves a narrow investigation, some slapped wrists and then a quick return to the way things were. Itās a waiting game: the public furore will die down as something else comes to dominate the news cycle. That leaves us as vulnerable as we are now to the next threat.
The better path is harder. But itās the only way to rebalance the relationship between government and big tech.
Australia needs to stare down the denials and obfuscation from the companies who claim AI is beyond anyoneās control. Instead, our government should be as serious about addressing the risks from AI as it is about seizing the economic opportunities. That means our laws and enforcement need to be taken seriously. When an incident like this happens, it must be taken seriously enough to stop the āmove fast and break thingsā attitude where tech companies run live experiments on millions of Australians and our critical infrastructure with no consequences.
At the UN, Albanese encouraged the world to come together for real action to address the greatest threats posed by AI. He was right. But now our countryās actions must match the rhetoric. Australia should be open for business only with companies that build safe systems, respect our laws and support our values. That means taking a leadership role in setting international rules, ensuring independent testing of AI systems before they go live, and making sure the rules hold.
In other words, the time for āwait and seeā is over. And if we fear that this will upset US big tech, perhaps we should recall the words of US president Franklin D Roosevelt, who warned that no one ācan tame a tiger into a kitten by stroking itā
We need to demand companies keep their AI agents under control and, if they donāt, we need to enforce the law. Thereās not a moment to lose.
