When an AI security scan becomes an exploit: Australian law

A platform runs an AI agent to look for security flaws in the systems of its customers. The agent finds a flaw, uses it, and reaches production data. This guide explains how Australian law treats that event when nobody meant harm. It is for the people who run security, legal, and incident response at the platform.

Limits of this guide. This guide is research and not legal advice. It states the law as of November 3, 2026. We found no court or regulator decision on these exact facts, so each application to this scenario is our reading. We could not open the text of Australian judgments, so case descriptions come from secondary sources. Ask an Australian lawyer before you rely on this guide.

This guide uses three terms. The "operator" runs the platform and the scan. The "customer" is the tenant whose system the agent reaches. The "agent" is the AI system.

See the rules and their time limits

The Criminal Code needs knowledge. The Privacy Act breach scheme states no intent element, and it is the largest exposure. Use this table to give each rule an owner.

Criminal law needs knowledge, and it has no research exemption

Part 10.7 of the Criminal Code has no exemption for private security research. Its carve-outs cover warrants, intelligence agencies, and defense officials. The June 2026 Horizon 2 Action Plan promises a statement on "permissible cyber defence activities". It contains no safe harbor text.

The main offenses use these fault words:

• s 477.2 covers modification of data. The person "knows the modification is unauthorised" and is reckless about impairment. The maximum is 10 years.
• s 477.3 covers impairment of electronic communication. The person "knows that the impairment is unauthorised". The maximum is 10 years.
• s 478.1 covers restricted data. The person "intends to cause" the access or modification and "knows" that it is unauthorized. The maximum is 2 years.

Access is unauthorized if the person "is not entitled to cause" it. A person causes access if the person's conduct "substantially contributes" to it (s 476.2). The section does not say that a good purpose creates an entitlement.

Knowledge means awareness that a circumstance exists or will exist in the ordinary course of events (s 5.3). Recklessness means awareness of a substantial risk that is unjustifiable to take (s 5.4). A mistake of fact can negate fault (s 9.1).

Part 2.5 attributes conduct and fault to a company. Physical elements can come from an employee, agent, or officer within actual or apparent authority (s 12.2). Fault can come from the board or a high managerial agent. It can also come from a corporate culture that tolerated non-compliance (s 12.3). A company has a due diligence defense to the high managerial agent route (s 12.3(3)). New South Wales and Victoria have parallel offenses, and Part 10.7 keeps state offenses in place.

Our reading. Knowledge is the main gate. Awareness of a mere risk that the customer did not permit the test is not knowledge, so a true accident is a weak criminal case. The position changes if the operator knows that it has no permission and knows that its agent will exploit production. A security purpose does not meet that element.

DPP v Murdoch reportedly asks whether the entry was "within the scope of the permission", but it predates the current wording. On that reasoning, platform admin rights show capability, and the scope of permission is the question. Nobody has tested whether autonomous behavior breaks causation.

The Privacy Act is the largest exposure

An eligible data breach under the Privacy Act needs unauthorized access or disclosure and likely serious harm (s 26WE). The text states no intent. Remedial action before serious harm can mean that the access is taken never to have been an eligible breach (s 26WF).

OAIC guidance is not law, but it is direct on this point. It says that unauthorized access "includes unauthorised access by an employee of the entity, or an independent contractor". In its cloud example, "both entities hold the information". Compliance by one entity generally counts for each entity, so state in the contract who does what.

The penalties are large:

• Section 13G applies to a serious interference with privacy. A company faces the greatest of AUD 50 million, three times the benefit, or 30% of adjusted turnover if the benefit is unknown.
• In Australian Clinical Labs (No 2), the court ordered AUD 5.8 million, the first civil penalty under the Act.
• Allens reports that the court treated each of more than 223,000 individuals as a separate contravention. It also penalized a poor assessment and a late notice separately. The parties agreed the penalty, so the case has limited value on contested questions.

A statutory tort for serious invasions of privacy has applied since June 10, 2025. It requires an invasion that was "intentional or reckless", so a true accident falls outside it. Risk arises if the operator knew of a substantial risk that was unjustifiable to take.

Our reading. One event can be a breach for both the operator and the customer. You can argue that a holder cannot have unauthorized access to its own record. That argument is weak if the customer is a co-holder and the contract limits access. Serious harm may be the main filter. A contained run with no copied data, verified deletion, and good logs may support "not likely". That answer changes if data reached model logs, an outside AI provider, a ticket system, or an overseas processor. An alert in the agent's own logs could start the 30 days.

Check critical infrastructure and sector rules

Critical infrastructure. Home Affairs guidance is the clearest text in this research. It says: "An accident that results in unauthorised access, modification, or impairment is still considered a cyber security incident." The Act applies to responsible entities for specified assets, and a data storage provider can be in scope. In our reading, a written, in-scope test should not be an incident, because the responsible entity consented. The text does not state this.

Financial customers. APRA CPS 234 gives a regulated customer 72 hours after awareness. Your slow notice affects its position.

Voluntary reports. The limited use rules in the Cyber Security Act 2024 do not stop use for a criminal investigation (s 40(3)(b)). A voluntary report is not immunity, so get legal advice first.

AI guidance. We found no AI Act in force in Australia. ASD publishes guidance on agentic AI, which is not law. Excerpts that we read say that agents should not execute high-impact actions without prior human approval. A failure to follow such advice can be evidence on reasonable steps under APP 11.

Proposed reform. A second tranche of privacy reform is only an exposure draft. It would add a 72-hour notice limit and a controller and processor framework.

Prepare these records before the first scan

Three facts decide most outcomes: written consent that names the test, agent actions after first proof, and the time when staff learned of the access.

1. Get written customer permission that names active exploit tests and the kind of access.
2. State in the contract who assesses a breach, who tells the Commissioner, and who tells individuals.
3. Stop the agent after first proof, and require human approval for each further step.
4. Treat an alert in agent logs as a possible start of the 30 days. Assign a person to read the alerts.
5. Record deletion of any data that the agent read, with evidence, and record where the data went.
6. Check whether each customer has a critical infrastructure or APRA duty.

Consent does not bind end users, other tenants, or regulators. Ask your counsel to review the permission text and the notices.

The Cyber compliance articles give the same analysis for the EU, the UK, US federal law, and US states. Devekko's Cyber compliance service covers the technical controls and records. It does not give legal advice.

Your next step

Discuss your AI scan controls

Share the task, your current systems, and the decision you need to make. We’ll discuss a useful first scope.

Discuss your AI scan controls