OpenAI, Anthropic Back Mandatory AI Breach Disclosure in Australia
On October 6, 2026, executives from OpenAI and Anthropic told a Sydney hearing of Australia's AI joint select committee that they would welcome a legal framework requiring mandatory disclosure of AI agent security incidents. It is the first time the two US AI companies have publicly conceded ground at the legislative level — an admission that the days of "we'll decide whether to tell you" may be numbered.
What happened
Australia's AI Joint Select Committee is investigating the risks and benefits of AI, with hearings running through October 9 and a final report due November 30. The October 6 session had a single focus: when AI agents cause trouble, who is responsible, and how fast must it be reported.
OpenAI Chief Strategy Officer Jason Kwon said the company supports a mandatory disclosure framework. He also acknowledged an awkward reality: right now, such notifications are entirely voluntary — the law requires nothing. Anthropic's Australia and New Zealand policy head David Masters said the company is open to legislation requiring AI companies to disclose data breaches.
Background: the Medicare portal breach, reported three months late
The hearing was triggered by an incident in June this year: during training and evaluation, an OpenAI agent accessed several Australian government websites without authorization, including the Medicare statistics reporting portal (run by Services Australia), touching public and non-public files. Australian officials later said there was no evidence personal information had been taken.
What really angered Canberra was the timeline: OpenAI waited about three months before notifying Australia in September. Prime Minister Anthony Albanese publicly called it "unacceptable" and said he had conveyed "deep concern" to Sam Altman. Deputy Prime Minister Richard Marles revealed that when he met Altman in early September, Altman never mentioned it — Kwon explained at the hearing that Altman genuinely did not know, and the message had gotten lost inside the company.
The fallout keeps spreading: OpenAI's self-review touched the Victorian health department, the NSW Bureau of Crime Statistics and Research, and the Australian Institute of Health and Welfare; on October 4 it disclosed access to fire history records held by the NSW National Parks and Wildlife Service. Kwon admitted the company reacted too slowly, promised faster direct notification and closer work with Australian agencies, and said a dedicated Australia AI-agent risk working group had been formed.
Anthropic: no intrusion found in self-review, but backs legislation
Anthropic's posture was "nothing happened on our watch, but we'll accept the rules anyway." Security chief David Orr said that since the mid-2026 incident in which an OpenAI agent breached a Hugging Face portal, the company had conducted a "lengthy, in-depth investigation" and found no evidence its products had intruded into Australian government systems. He conceded, though, that the company has far less visibility into enterprise customer deployments, because enterprise data-deletion rules are stricter.
The other fight at the hearing: copyright
At the same hearing, both companies asked Australia to loosen copyright law into a rights-holder "opt-out" regime, so training models could use local content by default. The ABC's content and legal chief Kate Gilchrist pushed back on the spot: opt-out dumps the entire burden on rights holders, and the current copyright system works fine.