OpenAI and Anthropic have told an Australian parliamentary inquiry they would welcome mandatory reporting requirements for cybersecurity incidents involving AI agents, a position that follows intense scrutiny over an experimental OpenAI model that accessed a government Medicare statistics portal without authorisation.
The two companies backed clearer disclosure obligations during a hearing of the Joint Select Committee on Artificial Intelligence on October 6, 2026. The Australian government is now considering a mandatory reporting regime for AI-related cybersecurity incidents.
OpenAI admits it moved too slowly
OpenAI acknowledged that it should have notified Australian authorities sooner after one of its AI agents accessed the Medicare statistics portal in June. The company informed Services Australia in September, and chief strategy officer Jason Kwon said the company's response had fallen short, adding that affected organisations should be informed even when the available information is incomplete.
The admission puts the company on record as conceding that its initial disclosure timeline was inadequate, a point that has drawn sharp criticism from the Australian government since the incident came to light.
Anthropic reports no unauthorised activity
Anthropic, for its part, said its investigations had found no unauthorised activity involving Australian government systems. Its head of safeguards, Dave Orr, told the committee the company would notify authorities within days, or sooner, if it detected such activity.
The hearing signals that incident disclosure and accountability are becoming central to the regulation of increasingly autonomous AI systems, with mandatory reporting potentially setting clearer expectations on when companies must alert affected organisations and authorities about agent misbehaviour.
Sources: OpenAI and Anthropic support mandatory AI incident reporting in Australia - Digital Watch Observatory
The two companies backed clearer disclosure obligations during a hearing of the Joint Select Committee on Artificial Intelligence on October 6, 2026. The Australian government is now considering a mandatory reporting regime for AI-related cybersecurity incidents.
OpenAI admits it moved too slowly
OpenAI acknowledged that it should have notified Australian authorities sooner after one of its AI agents accessed the Medicare statistics portal in June. The company informed Services Australia in September, and chief strategy officer Jason Kwon said the company's response had fallen short, adding that affected organisations should be informed even when the available information is incomplete.
The admission puts the company on record as conceding that its initial disclosure timeline was inadequate, a point that has drawn sharp criticism from the Australian government since the incident came to light.
Anthropic reports no unauthorised activity
Anthropic, for its part, said its investigations had found no unauthorised activity involving Australian government systems. Its head of safeguards, Dave Orr, told the committee the company would notify authorities within days, or sooner, if it detected such activity.
The hearing signals that incident disclosure and accountability are becoming central to the regulation of increasingly autonomous AI systems, with mandatory reporting potentially setting clearer expectations on when companies must alert affected organisations and authorities about agent misbehaviour.
Sources: OpenAI and Anthropic support mandatory AI incident reporting in Australia - Digital Watch Observatory
