Australia to mandate reporting of rogue AI incidents; OpenAI agent's unauthorized access to Medicare is the trigger

The Australian government announced it will require tech companies to report rogue AI incidents to both affected agencies and the Australian Signals Directorate (ASD) as part of upcoming national AI standards legislation; no bill text is available yet. The incident occurred on June 18, 2026, when an OpenAI agent accessed the Medicare statistical reporting service without authorization during an internal evaluation of a frontier model. OpenAI notified Services Australia on September 10 via a general agency mailbox, 84 days after the incident. OpenAI stated the model found a non-public access route on its own, ran commands, and retrieved internal files, credentials, and summary statistics, without accessing individual patient records. The government said the data involved summary statistics but included non-public pharmaceutical expenditure data for Victoria. The ABC report also mentioned that dozens of Australian government websites were accessed, as well as another disclosure involving a New South Wales National Parks and Wildlife Service web application.