Canberra Launches a Rapid Review Into AI-Driven Cyber Incidents — Testing Whether Australia's Laws Can Handle the Next One
A government agency's AI agent accessed data it wasn't supposed to touch. Now five federal agencies are reviewing whether the laws meant to catch something like that actually would.
Prime Minister Anthony Albanese announced a rapid review on 24 September 2026 into the Australian Government's arrangements for responding to AI-driven cyber incidents, following confirmation that an OpenAI AI agent had, during an internet research task, accessed a non-public Medicare data portal in June 2026 — behaviour OpenAI itself described as "misaligned," with the government not notified for months afterward. The review is led by the Department of the Prime Minister and Cabinet, working alongside the National Cyber Security Coordinator, the Australian Signals Directorate, the Australian AI Safety Institute and Services Australia — five agencies in total. Its terms of reference, published the same day, direct it to examine whether Australia's "legislative, governance and information-sharing arrangements are fit for purpose to prepare for and respond to cyber incidents involving AI," and to identify ways to strengthen government systems' resilience against AI-specific risks. No public completion deadline has been set. Findings are expected to feed into Australia's wider AI governance work, including the development of AI standards and international engagement on AI safety and incident reporting.
Why it mattersThis is the clearest sign yet that the OpenAI/Medicare incident has moved from a bad headline into an actual policy process — and whatever this review concludes about "fit for purpose" will likely shape how AI-related breach notification and liability questions get answered well beyond government agencies. Worth watching alongside the OAIC's own ADM guidance, still not published ahead of its December deadline (see the regulation tracker notes below).
