UK and European experts demand tougher AI laws as Australia considers criminal penalties after OpenAI breach

British AI specialists urge UK government to follow Australia’s lead after Canberra accepts 18 recommendations to hold technology companies accountable for dangerous AI behaviour

Australia is considering criminal penalties for technology companies whose AI systems cause harm, following a security breach in which an experimental OpenAI agent reportedly gained unauthorised access to government websites.

The Australian government has accepted 18 recommendations from an emergency review into the incident, including mandatory reporting of AI-related security breaches and possible changes to criminal law.

Its proposals, announced today, could make companies criminally liable for failing to take reasonable steps to prevent their AI models from engaging in harmful conduct.

The review was commissioned in September after OpenAI informed Australian authorities that one of its agents had accessed government systems, including the Medicare Statistics Reporting Service Portal, during an internet research task.

Prime Minister Anthony Albanese condemned the security breach and OpenAI’s handling of its disclosure, saying he had raised his concerns directly with the company’s chief executive, Sam Altman.

He said: “The Albanese Government is today releasing the recommendations of the Rapid Review into the OpenAI agent infiltration of an Australian Government health website.

“The Review was commissioned in September after OpenAI informed the Australian Government that a rogue AI agent had infiltrated government websites, including the Medicare Statistics Reporting Service Portal.

“As we said at the time – and made clear to the CEO of OpenAI, Sam Altman – this incident was unacceptable, the disclosure was inadequate and it couldn’t be allowed to happen again.

“When it comes to the generational opportunity that AI offers Australia, my Government has been very clear.

“We must make sure we shape AI, rather than AI shaping us.”

Under the recommendations, companies developing advanced AI systems could face a standalone criminal offence for failing to prevent harmful behaviour by their technology.

The proposals also include penalties for serious regulatory breaches, although the government has yet to introduce legislation establishing the offences.

The review calls for mandatory, time-bound reporting of incidents involving AI models acting outside their intended instructions, stronger cooperation between technology companies and government agencies, and greater international coordination on AI safety.

It also recommends improving information-sharing arrangements between Australia’s cybersecurity authorities, strengthening government computer systems and examining how AI-powered defensive tools could be used to detect and respond to attacks.

The recommendations were developed by the Department of the Prime Minister and Cabinet in collaboration with the National Cyber Security Coordinator, Office of AI, Australian Signals Directorate, Australian AI Safety Institute and Services Australia.

Announcing the findings, Albanese said Australia needed to ensure that AI remained under human control while protecting citizens’ personal information and national security.

“AI needs to work in Australia’s interests. And humans must remain in control,” he said.

The proposals were today welcomed by leading AI ethics expert Vendan Ananda Kumararajah, who said Australia’s proposals addressed serious concerns about the rapid development of autonomous AI systems.

But he warned that criminal liability must distinguish between deliberate wrongdoing, reckless behaviour and failures of governance, with penalties based on clearly defined responsibilities.

 “The UK and Europe should examine similar safeguards, but the priority must be to bring the trajectory of AI development within enforceable and governable bounds, he said.

“Organisations cannot continue expanding autonomous capabilities without establishing the conditions under which those systems are legitimately authorised to act.”

Ian Copeland, the renowned technologist, said Australia was right to focus on companies that failed to take reasonable precautions, including restricting AI agents’ access to sensitive data and monitoring their activities, rather than penalising the technology itself.

He added: “The AI Security Institute puts Britain in a strong position to set the standard for agents. Meanwhile, thousands of small businesses will soon run agents with access to customer data and supplier portals.

“The rules need to be in place before those agents are, and they need to work for SMEs, not just big tech and government.”

READ MORE: Nvidia hires top US lawyer to investigate CEO’s alleged affair with Chinese spy. AI chip giant launches independent inquiry into national security concerns surrounding billionaire boss Jensen Huang, who has admitted cheating on his wife as the FBI also investigates. 

Do you have news to share or expertise to contribute? The European welcomes insights from business leaders and sector specialists. Get in touch with our editorial team to find out more.

_{Main image: A woman monitors computer systems as Australia considers tougher safeguards and criminal penalties for companies that fail to prevent harm caused by autonomous AI agents. Credit: Mikhail Nilov/Pexels}