OpenAI and Anthropic back AI incident reporting rules in Australia

By Splitfeed EditorialLast updated Oct 6, 2026, 08:30 UTC

On October 6, 2026, both OpenAI and Anthropic told Australian authorities they would welcome mandatory reporting rules for data breaches and hacks involving AI agents. Anthropic explicitly stated it is open to legislation requiring disclosure of AI agent security incidents, while OpenAI indicated it would support similar data breach reporting requirements. Separately, OpenAI issued an apology to Australia connected to a hack affecting the country and said it wants to rebuild trust with Australian users and regulators. The two statements together placed both major AI labs on record backing a form of regulatory oversight that governments in several countries have been debating.

The significance here lies partly in the rarity of large AI companies voluntarily endorsing mandatory compliance frameworks before those frameworks are finalized. Governments considering AI regulation often face industry resistance, so public support from OpenAI and Anthropic gives Australian legislators a different kind of political landscape to work within. The OpenAI apology adds texture to the story: one reason firms may be signaling openness to disclosure rules is that incidents have already occurred and been made public in ways that damaged trust. What remains genuinely in dispute is whether voluntary endorsement of reporting rules translates into meaningful accountability, or whether the specific scope and enforcement mechanisms of any resulting legislation will have enough teeth to matter.

The pro-AI camp has not yet reacted to this story directly. That camp would typically argue that industry self-alignment with reasonable reporting standards shows AI companies can engage constructively with regulators without heavy-handed intervention. The anti-AI camp's quoted reactions do not address the Australian regulatory question directly, but the accounts that did respond focused on grievances around data practices. Richard Arguile, posting as @grenvilles.bsky.social, said that Anthropic scraped book contents from a pirate site and called it theft, while John Scalzi, posting at @scalzi.com, expressed doubt that he would ever receive compensation for 28 years of writing on his blog. Both reactions reflect a broader skepticism about whether AI companies' public gestures toward regulation address the underlying harms critics care most about. The middle ground camp has not yet commented, but it would typically argue that incident reporting rules are a reasonable first step, provided they come with clear definitions, independent oversight, and consequences for non-compliance.

The concrete detail to watch next is whether Australia introduces draft legislation setting out the specific scope of mandatory AI incident reporting, including what counts as a reportable event, who must report, and what penalties apply for non-disclosure. How OpenAI and Anthropic respond to the specifics of any such draft will be more telling than their current general statements of support.