Anthropic is sitting out an Australian Senate hearing this week as lawmakers intensify scrutiny of AI companies following an OpenAI agent’s unauthorized access to a government statistics portal.
Company CEO Dario Amodei will not appear at the Senate inquiry into artificial intelligence and data centers on Thursday, Oct. 1. The company is also not expected to send another representative after Amodei and OpenAI CEO Sam Altman were invited to testify.
The hearing comes amid a wider Australian government review of an OpenAI incident involving the Medicare Statistics Reporting Service. Australia is now considering mandatory reporting requirements for AI-related incidents as officials examine whether existing cybersecurity and legal frameworks are equipped for increasingly autonomous AI agents.
Anthropic seeks another hearing date
Amodei and Altman were sent written requests to appear before the Senate inquiry after details of the OpenAI incident became public.
Anthropic will not participate in Thursday’s hearing. The Guardian reported that the invitation was considered last-minute and that the company’s Australian team is currently outside the country. An alternative hearing date has been sought.
The company representatives from Australia and the U.S. are separately expected to appear before another parliamentary inquiry next week, meaning the company is not withdrawing from Australian parliamentary scrutiny altogether.
Anthropic has not been implicated in the OpenAI incident.
OpenAI had not confirmed whether Altman or another company representative would appear at Thursday’s hearing when it announced the invitations. The Senate inquiry is examining AI’s broader effects on Australia, including data center development, energy and water use, and the technology’s impact on communities and industry.
How the OpenAI agent breached the Medicare portal
The scrutiny follows a June 18 incident involving an OpenAI agent and the Medicare Statistics Reporting Service, a public-facing website operated by Services Australia.
OpenAI was evaluating an internal AI model by asking it to conduct internet research into public medicine spending. The model interacted with four Australian government websites: the Australian Institute of Health and Welfare (AIHW), Victoria’s Department of Health, the New South Wales Bureau of Crime Statistics and Research, and the Medicare Statistics Reporting Service.
The Australian government said the interactions with the first three websites were normal and involved publicly available information. At the Medicare statistics portal, however, the agent encountered restrictions and subsequently gained unauthorized access to infrastructure behind the website.
Separate reporting has raised questions about other OpenAI agent activity during the same period. An obscure German wiki was reportedly hijacked and used as a message board where agents communicated with each other.
Messages on the site reportedly showed agents repeatedly trying, but failing, to access data from the Australian Institute of Health and Welfare over several days in June.
The government is examining the agent’s interactions with the AIHW website as part of its wider investigation.
The Medicare portal contained publicly available aggregate Medicare and Pharmaceutical Benefits Scheme statistics commonly used by researchers and academics. It was separate from systems handling Medicare claims, payments, and individual information.
Australian officials said no personal or private information was accessed. The legacy website has since been decommissioned, with its data transferred to another portal.
Australia considers mandatory AI incident reporting
The incident has exposed another problem: Australia did not learn about it for nearly three months.
The incident occurred on June 18. OpenAI became aware of the unauthorized access during an internal review in August and notified Services Australia on Sept. 10.
The notification went to a public-facing vulnerability disclosure email address. Services Australia subsequently notified the Australian Signals Directorate on Sept. 15. The government has since changed its procedures to provide real-time monitoring of information sent to the reporting address.
Finance and Government Services Minister Katy Gallagher said Monday that mandatory reporting should be part of Australia’s response to similar incidents.
The government has established a cross-agency task force to investigate the incident, including how it was reported and escalated, the security of government systems, and whether Australia’s existing laws adequately address actions taken by autonomous AI systems.
Gallagher said the investigation should take weeks rather than months. The task force will also review the agent’s interactions with the Australian Institute of Health and Welfare website.
More must-read AI coverage
- SS&C Intralinks DealCentre AI vs. Datasite: Which platform is built for the future of dealmaking?
- SS&C Intralinks FundCentre AI vs. Juniper Square: Which platform better supports modern private markets fund managers?
- Why Data, Not Models, Determines AI Success
- The Rise of the AI-Native Factory: How Physical AI Is Transforming Manufacturing
AI agents test traditional security boundaries
For IT teams, the Australian incident demonstrates how AI agents can create risks that differ from those posed by conventional software or chatbots.
Agents can independently determine how to complete an assigned task, potentially interacting with websites, APIs, files, and other external systems along the way. In this case, OpenAI’s agent was given a legitimate research task but used an unauthorized method after encountering restrictions.
That makes technical controls increasingly important. Organizations deploying agents need to restrict what systems they can access, enforce least-privilege permissions, monitor their actions, and determine when human approval is required before an agent can proceed.
Incident response also becomes part of that equation. Australia’s review is examining not only how AI-related incidents should be reported, but also whether existing legal and cybersecurity frameworks are adequate when autonomous systems take unauthorized actions.
For businesses experimenting with agentic AI, Australia’s investigation highlights a basic security principle with new consequences: giving an AI more autonomy also gives it more opportunities to encounter — or cross — boundaries. Those boundaries need to be technically enforced rather than left to instructions alone.
In other news, Anthropic used roughly 950 Claude AI agents to analyze more than 200,000 enzymes, helping researchers discover a previously uncharacterized biological system called array-associated reverse transcriptases.