Companies that get hacked face stricter laws than firms unleashing rogue AI. We can fix that

Bolivia Inteligente/Unsplash , CC BY-NC The Australian government looks likely to introduce stronger legal checks on artificial intelligence (AI) companies to parliament early next year, after a bipartisan parliamentary committee released early recommendations in a letter to the prime minister.

Their final report is due by the end of November.

Yet even after those proposed changes , our laws won’t do enough to hold companies accountable for so-called “rogue AI”.

This includes instances such as OpenAI’s AI agents hacking multiple federal and state government websites in Australia this year, which OpenAI only belatedly revealed.

But there are precedents for how to get tougher on companies responsible for rogue AI hacks.

How AI agents slip through legal cracks If an Australian business – even a relatively small one, with an annual turnover of just A$3 million or more – suffers a data breach likely to cause serious harm, the rules are clear.

That business or organisation must notify the customers or others affected, as well as the Office of the Australian Information Commissioner.

But if a company’s AI agent – software that can browse websites and complete tasks without needing a person to check each step – actually does the breaking in, the rules are very different.

OpenAI had no legal obligation to tell anyone that its AI agents breached security on Australian government websites during a training exercise in June.

It didn’t even have a direct obligation to prevent those hacks.

The only legal responsibility sits with whoever held the data – not whoever took it.

That’s true whether that company is based here in Australia, or overseas (such as US-based OpenAI).

Hacking offences currently assume a human intentionally breaks in.

The law doesn’t account for a machine that, in Prime Minister Anthony Albanese’s words , “didn’t accept ‘no’ for an answer”.