Open AI attacked Australia’s health system – and then doubled down on its negligence. The time for ‘wait and see’ is over | Kate Crawford and Edward Santow

When you get sick, Medicare exists to take care of you. It sits at the centre of a health system that our prime minister rightly calls the envy of the world. It’s one of the few institutions nearly every Australian still trusts. So when an AI company threatens this system, it couldn’t be more serious.

We are at the UN general assembly this week and the OpenAI hack has put Australia in the spotlight during an expanding cybersecurity crisis. World leaders are calling for stronger oversight of frontier models. We know Medicare must be secure or our doctors and hospitals cannot do their jobs. But this breach is also a test of something larger: whether the Australian government can hold a US tech giant to account when its technology goes rogue. If Australia can’t protect our community – if it can’t enforce our laws and prevent such attacks happening again – then we are entering a terrifying period.

Let’s start with what happened. OpenAI is one of the most powerful companies on Earth. Its AI agents were let loose with a pretty mundane task: to gather information on public health systems around the world. When those agents couldn’t immediately get what they wanted from public websites in Australia, they did not stop. They broke in, hacking into a secure database to get the information they were told to find. To be clear: hacking is unlawful. Human hackers face serious consequences, and so must AI companies. There is no excuse for what happened.