In June 2026, an experimental OpenAI research agent, tasked with studying public medical spending, gained unauthorised access to Australia’s Medicare statistics portal. OpenAI says it learned of the breach in August and calls it unintentional. Canberra was told in September. On 10 November, the government answered with a new AI safety regulator and mandatory reporting of misaligned behaviour.
This assessment asks the question the Australian package is built around: if one of your agents did the same, how long until the right people knew?
The rapid review’s headline recommendation was mandatory reporting by AI companies of misaligned behaviour — an agent pursuing its goal by a route its operator never intended — alongside cyber incidents. That phrase moved from AI safety research papers onto a regulatory form.
The proposed standards target frontier AI companies operating in Australia. But the controls they assume — scoped agent identities, egress allow-lists, tamper-resistant logs, a reportability decision with a deadline — are the same ones your enterprise customers will start writing into contracts long before any statute reaches you.
Australia is the first government to build a frontier-AI safety regime directly in response to an autonomous agent crossing a legal line on a public system. It won’t be the last.
Status as reported 10–12 November 2026. Legislation is reported to be expected in 2027. OpenAI’s statement that no patient records were accessed is the company’s own account.
30 questions across seven control domains, about 12 minutes. You get a readiness score, your estimated breach-to-notice time plotted against real reporting windows, and your five highest-leverage fixes, mapped to ISO/IEC 42001, NIST AI RMF and the OWASP Top 10 for Agentic Applications.