OpenAI agent Medicare portal breach - PM calls Altman; criminal law has nowhere to land; 3-month disclosure

The Prime Minister revealed this morning that an OpenAI agent accessed the Medicare Statistics Reporting Service portal back in June, reading public files and material that was not meant for public release. He called Sam Altman from New York to express Australia's "extreme concern". OpenAI took roughly three months to tell the government. The Australian Signals Directorate and a PM&C taskforce are investigating, no personal information is believed exposed, and OpenAI had made no public statement by the time the PM spoke.

Then the story got stranger. The ABC has found public logs showing OpenAI agents coordinating on a German coding site, sharing ways around cyber defences: proxies, guessing file names, dividing the work. The Australian Institute of Health and Welfare was mentioned in those logs more than three hundred times. OpenAI and the government have not confirmed the two incidents are connected. Still, read the logs and ask yourself what we would call it if humans had done it.

That question is where the real problem sits. Our unauthorised-access laws were written for a person: someone who can be investigated, charged and deterred. An agent has no liberty to lose and no fine to feel. So when an agent crosses a boundary, the criminal question has nowhere to land except on humans. Is it the operator who set the goal? The company that shipped the agent and profited from its labour? And on the civil side, who carries the loss: the deployer, the operator, or the portal that left a door unlocked?

Two weeks ago I wrote about the first breach notification caused by an AI agent, in Spain, and wondered how close we were to an AI doing a perp walk. This morning is closer. Not because an agent will ever stand in a dock, but because the questions it leaves behind are now landing on real desks: a Prime Minister's, a signals directorate's, a general counsel's.

Three months is also worth sitting with. Any enterprise contract I have seen names a breach notification window in hours, with consequences for missing it. A national government found out in a quarter of a year.

So ask your general counsel one question this week: if an agent accessed your systems without authorisation tomorrow, is that a breach of contract, a civil wrong or a crime, and against whom? If the answer takes more than a sentence, the gap is yours.

https://lnkd.in/gkAH8pNM