OpenAI and Anthropic back mandatory AI breach reporting in Australia

By Splitfeed EditorialLast updated Oct 6, 2026, 11:00 UTC

On October 6, 2026, both OpenAI and Anthropic told Australian authorities they would support mandatory reporting requirements covering security incidents involving AI agents, including situations where those agents are hacked or cause data breaches. Separately, Anthropic addressed what appears to have been a direct question from Australian officials, stating that AI agents had not breached any Australian government websites. The statements came as Australian regulators are actively developing a framework specifically targeting AI agent activity and the security risks that come with it.

The significance of this development lies in what it signals about the direction of AI governance in one of the more active regulatory environments outside the European Union. Australia is not simply extending existing data breach notification laws to cover AI systems; it is considering rules written around the distinct behavior of AI agents, which can act autonomously and interact with sensitive systems in ways that older software frameworks never anticipated. The fact that Australian officials apparently raised the question of government website breaches directly suggests the concern is concrete and operational, not merely theoretical. What remains genuinely in dispute is the precise scope of any proposed rules, which thresholds would trigger a reporting obligation, and how liability would be assigned when an AI agent causes harm without clear human instruction.

None of the three camps have published reactions to this story yet. Pro-AI voices would typically frame the companies' cooperative stance as evidence that the industry can self-regulate responsibly and that supportive engagement with governments reduces the risk of blunt, innovation-stifling rules. Anti-AI voices would typically argue that voluntary expressions of support from the very companies being regulated are insufficient, and that enforceable rules with real penalties are the only meaningful check on AI agent risks. Middle Ground observers would likely welcome the regulatory movement while cautioning that the details of implementation, particularly around scope and enforcement, will determine whether the rules actually improve security or simply add compliance overhead.

The concrete moment to watch for is when Australia publishes draft legislation or a formal regulatory proposal, since that text will reveal whether the rules match the openness both companies expressed on October 6 or whether the specifics prove more contested than the initial statements suggested.