OpenAI and Anthropic told an Australian parliamentary inquiry on 6 October that they would support laws requiring disclosure of data breaches committed by AI agents.
According to Reuters, OpenAI’s chief strategy officer Jason Kwon supported a mandatory disclosure framework, while Anthropic’s Australian and New Zealand policy head David Masters also expressed support. The evidence follows scrutiny of OpenAI’s delayed notification that an experimental agent had accessed Australian government systems without authorisation. The companies’ statements signal support for legislation; they do not, by themselves, establish a new reporting obligation.
The consequential development is the move towards an externally imposed reporting standard. Decisions about when an autonomous system’s conduct warrants notification could become matters of enforceable public accountability, rather than internal company assessment.
For lawmakers, the design questions include what constitutes a reportable incident, when the reporting clock starts, who must receive notice and how obligations apply across model providers, developers and organisations deploying agents. A framework would also need to address unauthorised actions that expose weaknesses without taking personal information.
For lawyers advising on agent deployment, the practical implication is that contracts and governance processes should make incident detection, evidence preservation and escalation responsibilities explicit. Permission controls matter, but so does a reliable record of what an agent actually
Sources: Reuters reporting; parliamentary inquiry.
Leave a Reply