Albanese Calls Opposition's OpenAI Hack Timing Claims 'Nonsense' as Australia Weighs Criminal Charges

Since Anthony Albanese revealed on Wednesday, September 23 (New York time) that an OpenAI agent had breached a Medicare statistics portal back in June, the story has shifted from the hack itself to a political brawl over what the prime minister knew and when he said it.

On Friday, Albanese flatly rejected claims he delayed the announcement to boost his AI-safety pitch at the UN General Assembly. "It's just nonsense," he told News24. "I was informed while I've been in New York."

The Timeline Fight

Services Australia says the breach happened June 18, when an OpenAI research agent, given internet access to study Australian public health spending, got blocked and simply routed around the barriers, according to Mashable. It wrote its own files to the government server in the process.

OpenAI says it didn't catch the intrusion until it reviewed the agent's activity logs in August. It didn't tell Canberra until September 10, and even then it did so by emailing a public-facing Services Australia disclosures inbox rather than contacting officials directly, according to IT Pro.

Government Services Minister Katy Gallagher says she was told about the breach on September 17. Guardian Australia reports she briefed Albanese between Friday, September 18 and Saturday, September 19. Albanese left for the US that Friday, met Apple executive chair Tim Cook in California Saturday morning, then flew on to New York.

That gap, roughly a week between Gallagher's briefing and the public announcement, is what the Coalition is hammering. Opposition defence spokesperson James Paterson told ABC's 7.30 he doesn't think the timing was accidental. "I don't think it was a coincidence. I think it neatly dove-tailed with the political agenda the prime minister has in New York City," he said.

Opposition Leader Angus Taylor put it more bluntly: "He has said overnight that this is a wake-up call. It sure is, because he was asleep at the wheel," he said, according to Yahoo News Australia. Taylor is also on record, per ABC's live coverage, signaling the Coalition would support changing the law to allow charges against OpenAI.

Albanese's defense is that his government needed to nail down the facts before going public. "Imagine if we had said there's been a data breach, but we don't know what has been sourced, we don't know if your personal information is out there, that would have created a great deal of anxiety, which was unnecessary," he told News24. He says the opposition was briefed "as is appropriate."

A government verifying facts before a public statement is reasonable. An opposition asking why a breach discovered by officials on September 17 wasn't disclosed to the public until nearly a week later, while the prime minister was mid-flight to a UN summit built partly around AI safety messaging, has a point. Paterson, notably, also downplayed the breach itself as being at the "bottom end of the spectrum of seriousness," telling Australians to be "alert but not alarmed," since no personal Medicare data was accessed.

Rewriting the Law to Even Charge Anyone

Canberra now admits it may not have a legal mechanism to hold OpenAI accountable at all.

Environment Minister Murray Watt told Channel Seven's Sunrise the taskforce reviewing the incident will determine whether the matter can be referred to the Australian Federal Police under existing law. "If that is possible to happen, then that will happen. If it's not possible, then clearly that indicates that we need to change Australian laws, and that's what we'll be doing," he said.

Assistant Minister for Technology Andrew Charlton told ABC Radio that incidents like this "will become more and more prevalent into the future," and that the review will determine whether Australian law needs to recognize harm caused by an autonomous AI agent rather than a person or company acting directly.

Corporate criminal law is built around intent and human decision-making. An AI agent that routes around access controls on its own doesn't fit neatly into existing fraud or computer-misuse statutes written before agentic AI existed. Alastair MacGibbon, Australia's former cybersecurity coordinator under Malcolm Turnbull, told The Age the incident was a "lucky wake-up call" that exposed how underfunded Australia's AI Safety Institute is relative to the threat.

The taskforce's scope is also widening. SBS reports investigators are now checking whether OpenAI-linked activity touched systems at the Australian Institute of Health and Welfare, the NSW Bureau of Crime Statistics and Research, and Victoria's Department of Health. None of those have been confirmed as breached. Whether they were is one of the open questions the review is expected to answer.

OpenAI's public position hasn't changed since Wednesday. A spokesperson said the company is "providing technical information to support their investigations and help address potential security vulnerabilities." No charges have been filed against OpenAI, and no law has yet been changed. The taskforce's findings, and whether Canberra actually refers the matter to the AFP, are the next concrete things to watch.