AI agents and government systems

OpenAI first emailed a public Services Australia mailbox about three months after the June incident. How quickly should a company have to tell government when its AI system accesses something it should not, and who should it tell?

Do you use government online services such as Medicare, myGov or state portals? Has this changed how much you trust them?

The Government says no personal information is believed to have been accessed, while investigations continue. What would you want confirmed before feeling reassured?

OpenAI says the activity came from an internal-only model without the full set of safeguards used in its public products. Should rules apply to AI systems during testing and training, not only to released products?

The taskforce will examine possible legislative responses and inform AI standards legislation, while OpenAI and Anthropic have offered voluntary notification commitments. What mix of law and voluntary commitment fits this situation?

The Opposition Leader framed this as a cyber defence issue; the Greens linked it to a moratorium on AI data centres. Is this mainly a security question, an AI regulation question, or both?

For people who work in IT or cyber security: what protections would stop an automated agent getting past a public-facing portal, and who should pay for them?

OpenAI said at the inquiry it should have told the government sooner; Anthropic pledged notice within days of any incident. Should these be voluntary pledges or legal obligations that apply to every AI company?

The taskforce includes the Australian Signals Directorate, the AI Safety Institute and Services Australia, and the matter has been referred to a parliamentary committee. What would you want its report to answer?

The NSW incident was disclosed in October, months after it happened in June. Are state and federal governments set up to find out about these incidents themselves, rather than relying on companies to report them?

If you use AI agents at work to browse websites or fill in forms, what limits do you or your employer put on them?

Several details are still unclear, such as exactly which files were accessed and whether other agencies were affected. Share any official statement or update that fills in the picture.

Some analysis argues the Medicare incident was not sophisticated and exposed little of importance; the Government calls it unacceptable. How serious do you think it was, and what would change your view?