OpenAI's delayed warning drives tougher approach to rogue AI

Australia is implementing stricter guidelines for handling security incidents involving AI agents. The federal government aims to ensure cyber authorities and relevant organisations are promptly informed of such incidents. OpenAI's chief strategy officer, Jason Kwon, will attend a parliamentary inquiry into AI next week to address these concerns.

Tech companies will be required to report rogue AI incidents to both affected organizations and Australia's cyber authorities. Labor has emphasized the need for a dual notification requirement following OpenAI's delayed and low-level response to a website breach. However, experts caution that mandatory reporting alone is insufficient.

They recommend increased investment in cyber security and the creation of "zero-trust infrastructure" to bolster defenses against AI incursions. The government has launched a consultation paper on national AI standards, suggesting companies could be compelled to disclose certain incidents to relevant Australian authorities, including the Australian Signals Directorate (ASD).

Services Australia recently took five days to inform the ASD about OpenAI's autonomous AI agent accessing non-public Medicare statistics from an old data portal. The government has since strengthened the monitoring of the public inbox used by OpenAI. A rapid review into the OpenAI breach is expected to conclude soon, informing the national standards legislation.

Labor aims to introduce this legislation before the end of the year, along with mandates for data centers and other cybersecurity measures. Experts argue that Australia should adopt engineering standards, audit trails, and other tracking methods for autonomous agents. As Treasurer Jim Chalmers noted, significant investment in cyber security is crucial, including training for the next generation of engineers and cybersecurity professionals.