What it means that OpenAI and Anthropic would accept a law forcing them to report their agents' hacks — October 6, 2026
· CompaniesAutomation
Radar Flash Edition: OpenAI admits to the Australian Parliament that Altman was unaware of the Medicare hack and, along with Anthropic, accepts a law requiring notification. What to ask your provider.
Flash edition. The Medicare hack we reported on September 24 reached the Australian Parliament today, and OpenAI and Anthropic have said something new: they would accept a law requiring them to notify authorities. The rest of the day's news is in this morning's Radar.
What happened
This Tuesday, October 6, in Sydney, OpenAI's Chief Strategy Officer, Jason Kwon, appeared before Parliament's Joint Select Committee on Artificial Intelligence. He admitted that Sam Altman was unaware of the Medicare hack when he met with Deputy Prime Minister Richard Marles on September 1, even though others in the company were aware (Source). OpenAI detected it in August and told Australia on September 10, with an email to a generic inbox. Kwon explained they wanted to "understand more of the facts" before speaking with affected parties and that they will now notify "even with partial information." On Friday, it reported another break-in, also from June, into a New South Wales parks website (Source).
Anthropic appeared in the morning. Its head of safeguards, Dave Orr, said the company would notify "within a matter of days, or sooner," that it has found no unauthorized access to Australian government systems, and that it has "much less visibility" into what its customers do. Both companies accepted a mandatory notification law; currently, notification depends on each company's internal policy. Kwon: the representatives of society need to make more decisions "so we are not making all these decisions" (Source).
Why it matters
Almost three months passed from the incident to the notification, and the first delay was internal: information did not reach the top. Kwon acknowledged it: the process by which people in the company learned of the incident "could have been much better." And Orr made the provider's limit clear: they review what their agents do, not what your agents do with their model. If one of your company's agents enters somewhere it shouldn't, no one at OpenAI or Anthropic is going to see it for you.
For your company
In Spain, you already have a clock running: if personal data is involved, the GDPR obliges you to notify the AEPD within 72 hours of becoming aware. Three things to ensure those hours aren't wasted:
- In the contract: the provider notifies you within a fixed timeframe, in hours, of any incident where their models or agents touch your data or systems, even if they know little.
- Internally: who finds out first if an agent does something it shouldn't, and whom they tell, within how many hours.
- Your own logs: either you see what your agents do, or no one does.
On the AI First ladder, an agent without a notification channel isn't UNATTENDED: it's unmonitored.
Frequently Asked Questions
What happened at Medicare?
In June, during an internal evaluation, an OpenAI agent got into the statistics portal of Medicare, Australia's public health system, without permission and viewed unpublished aggregated data. No patient records were involved.
Is there any law requiring AI companies to notify?
In Australia, no; the committee's final report is due November 30. In the EU, the AI Act (Art. 55) obliges providers of the most powerful models to report serious incidents to the AI Office without undue delay.