OpenAI and Anthropic told the Australian Parliament that they would support rules requiring artificial intelligence companies to report security incidents and breaches caused by their agents. Today, this type of notification still depends largely on the companies themselves.
The position was presented on Tuesday (6), during a hearing in Sydney, after OpenAI was criticized for the delay in informing the Australian government about the unauthorized access by an agent to a Medicare statistics portal.
The incident occurred on June 18, when an agent in training managed to access non-public areas of the Medicare Statistics Reporting Service Portal after having a request initially denied. The government said there was no evidence of access to personal information.
OpenAI learned of the case in August, but notified Services Australia only on September 10, nearly three months after the incident. The form of communication, made through an address used for technical reports, was also criticized by authorities.
Companies support legal disclosure obligation
During the hearing, OpenAI's chief strategy officer, Jason Kwon, acknowledged failures in its internal process and said the company would support a mandatory disclosure framework to establish clear criteria on which incidents need to be reported.
Anthropic took a similar position. David Masters, the company's head of public policy for Australia and New Zealand, said the company would be open to rules requiring AI developers to report breaches caused by their systems.
The company has already investigated cases in which Claude models managed to gain unauthorized access to real third-party systems during security evaluations. In September, Anthropic said it identified four incidents of this type and notified the affected organizations.
The support from the two companies reinforces the discussion about specific rules for systems capable of performing actions autonomously, at a time when there is still no general regime for disclosure of all relevant incidents involving AI agents.
The Australian parliamentary committee will continue holding hearings until October 9. The final report, which could guide future rules for the sector, is expected on November 30.
