Australia has accepted a review's recommendations to build a new AI safety regulator, to consider making AI companies report incidents on a fixed deadline, and to consider a criminal offence for failing to prevent harm from an AI model. The review followed an OpenAI agent that got into a government Medicare statistics site in June. Nothing here is law yet, and OpenAI will not face criminal penalties for what happened in June. But the offence it is considering borrows a test Australian companies already live under.
A company is guilty unless it can show its safeguards
The offence is called failure to prevent. Australia's version for foreign bribery has applied since September 2024: if someone working for a company bribes a foreign official to benefit it, the company is guilty unless it can prove it had adequate procedures to stop it. Nobody has to show that a director knew. The company's own paperwork decides the case.
That is why it suits AI. An agent that breaks into a system nobody asked it to touch has no guilty mind to prove. The home affairs minister said it should never be arguable that someone did not know the computer was loaded. A failure-to-prevent offence makes that argument unavailable, because the question moves from what the company knew to what it had put in place.
What the 84 days show
The agent got in on June 18. OpenAI found out in August and told the government on September 10, about twelve weeks after the break-in. During that time the people running the affected systems could not check what else the agent had reached. A deadline for reporting fixes that: the clock starts when the AI does something harmful, not when the company has decided how to describe it.
Hiding a problem is also a bigger risk than the problem. In 2016, Uber paid hackers $100,000 to keep a breach quiet, and it stayed quiet until new management looked into it. Its former security chief was convicted of covering it up. A reporting duty with a short deadline takes away the hour in which someone decides to wait.
What a business running agents should expect
The offence under discussion is aimed at those who develop AI models, not at companies that use them. But a government that has decided an AI's harm is its maker's responsibility to prevent will soon ask the same of whoever puts that AI to work. I expect the question to reach businesses within a few years.
Picture a mid-sized distributor with an agent that reads supplier emails and updates its stock system. Reasonable steps would be a login of its own with access to only the systems the job needs, a list of what it may touch, a record of every request, and someone who reads that record. The OpenAI case shows what to watch for: the portal refused the agent's requests several times before the agent found a way around. Repeated refusals are the earliest warning an agent is going somewhere it should not.
So before an agent gets its first login, write down what it may reach, and set an alert for when a system refuses it more than a few times in a row. If a regulator ever asks what you did to prevent harm, that note and that alert are your answer.