AI Policy and Governance Newsletter — November 2026

November 2026 Newsletter

10 November 2026

Albanese unveils AI safety package. Data centres sway votes in US midterms. Nvidia spy scandal gathers pace. Labs edge towards self-improving AI. Cyber attacks escalate.

Breaking: Frontier firms operating in Australia face new safety and security rules under a package announced by Prime Minister Anthony Albanese today, including security controls during development, independent model evaluation, swift notification of incidents and mandatory safety frameworks.

Albanese announced that an AI regulator would be set up to enforce the rules and slap penalties on companies for breaches. Companies will have to:

1. Maintain security controls across all stages of development and deployment
2. Identify and manage serious risks associated with their models
3. Allow independent evaluation of their models
4. Provide mandatory notification of incidents to the Australian Government rapidly
5. Maintain and publish safety and security frameworks to ensure good governance, risk management and transparency
6. Respond to updated standards and rules as technologies change.

The announcement follows the breach of the Medicare statistics portal by OpenAI agents, which prompted a rapid review by government departments and agencies. Albanese released the review's 18 recommendations and said Government would implement them in full. Australian ministers highlighted both the lessons and opportunities here after US voters rejected data centres in 40 of 41 local ballot measures while rewarding pro-regulation candidates in the midterms.

Meanwhile Nvidia boss Jensen Huang is under board investigation after he admitted to an affair with Alice Huang, reportedly a Chinese spy who may have been angling to sway the AI corporate rock star on chip sales to China.

Independent evaluator METR found Anthropic's use of AI for research had roughly doubled the pace of its model development over the past year, indicating significant progress towards recursive self-improvement. And the AI-enabled cyber pandemic continues to spread, with France blaming Iran for attacks on food storage fridges across the country, following the record US$6.3 billion (A$9.1bn) heist from crypto exchange Binance late last month.

Australia says safety first, then let's talk investment

The new obligations on frontier firms operating in Australia are light on detail but the Government's language offers some clues about its strategy. In short, without safety there's no trust; without trust, public support for the infrastructure investment needed to power AI and build a foundation for a sovereign Australian industry will remain flaky.

"We want AI investors to come to Australia but first and foremost we want to keep Australians safe," Albanese's statement reads. "That is why we are choosing to announce our approach to safety first and before a range of major international talks that will cover AI development and investment. Safety and security are the foundation for building trust in frontier AI."

The safety and security rules will be legislated as part of the Australian AI Standards and will be enforced by a newly created AI regulator, backed by expertise in the Australian AI Safety Institute (AISI). They will apply to all firms operating in Australia.

The more expansive 18 recommendations of the rapid review by government departments and agencies into the Medicare rogue agent breach will likely appeal to advocates of Australian AI capability, AI safety proponents and the national security community alike. Recommendation 2 is especially eye-catching: "In order to maximise leverage with frontier AI firms, the Australian Government [should] continue to encourage frontier AI firms to establish research, training and safety-related activities in Australia."

They call for new penalties for AI companies that recklessly lose control of models and agents, closer engagement by the government with industry and civil society experts, fresh diplomatic efforts to improve AI standards and norms, clearer crisis management plans, and a thorough look at government cyber defences.

AI on the ballot

Amid a "blue wave" of Democrat wins in the US midterms, data centres fared badly. Voters cited data centres as significant to their deliberations as they rewarded pro-regulation candidates such as incoming Texas Governor Gina Hinojosa. Chip stocks fell as much as 11 percent, their worst day since March 2020, as investors weighed construction limits alongside weak chip earnings.

Democrats including Bernie Sanders have renewed calls to pause new data centre development. Transformer's Shakeel Hashim wrote that "strong AI legislation now looks much more likely".

Australian ministers drew a lesson from the US result. "The unplanned and poorly managed rollout of data centres in the United States has imposed enormous costs on local communities and energy consumers. Australia will not repeat that mistake," Assistant Minister Andrew Charlton told an ACTU conference. Acting Prime Minister Richard Marles called it "a real opportunity for the country", adding that "you've got to get the social licence right". Government plans to ban new data centres from the suburbs and make them bring their own power and water, with legislation early next year. Politicians, staffers and industry figures told ABC national AI reporter Cam Wilson the US backlash could be avoided if Australia builds on "our terms".

Several major projects have run aground recently. Goodman Group scrapped its $1.2 billion Lane Cove project in Sydney after fierce local opposition, citing tighter rules and community feedback. Data centre firm NextDC was forced to slash its earnings forecast as it faced delays and community pushback to its massive West Footscray project in Melbourne. And the planned 1.2-gigawatt hub at Tungkillo, just east of Adelaide, has united the Greens, One Nation, the Liberals and Rebekha Sharkie against developer Quantum DC. A Quantum DC community event had to be cancelled because of a bomb threat. South Australian Premier Peter Malinauskas branded the US situation "madness".

"If it's going to happen in Australia, it cannot happen like that," he said.

Nvidia's spy scandal puts all the AI chips in one basket

Jaw-dropping revelations continue to come out about Nvidia boss Jensen Huang's relationship with Alice Huang, whom US intelligence reportedly concluded was a Chinese spy. She was an executive at Megaspeed, a Singapore data centre firm accused of helping Chinese companies get around US chip export controls. Given Nvidia's vicelike grip on advanced AI chips, every country including Australia will be watching nervously to see how badly this shakes the world's second most valuable company.

Nvidia is partnering with eight Australian data centre firms on up to 2 gigawatts of new AI capacity over the next year. With demand already well exceeding supply, the local industry will be hoping Nvidia doesn't miss a beat, however lurid the scandal becomes. Economic security experts might remind us that a global economy-defining supply chain that hinges on one company in the US, one company in Taiwan and one company in the Netherlands is not a safe arrangement.

A straight line on a log graph: capabilities march toward recursive self-improvement

METR, an independent evaluator given access to Anthropic's internal evidence, estimated that Anthropic is now improving its models on well-specified tasks at "around twice the rate" of 2024–25, with "a majority (perhaps ≈80%)" of the speed-up due to AI. This is consistent with Anthropic's amended prospectus for its initial public offering, which says its expectations for future models "indicate that we may imminently meet our Responsible Scaling Policy's definition of 'dramatically accelerated progress attributable to AI'", though no current model has crossed that line.

At the AI Joint Select Committee hearings, independent Senator David Pocock asked AISI general manager Kate Conroy whether pushing toward RSI was a good thing. Dr Conroy simply answered: "I'm just going to say it's happening. The labs are developing methodologies that are progressing towards that type of capability."

Progress in safety unfortunately is not matching the rapid advances in capability. OpenAI has now published 23 misalignment reports. In one, a GPT-6 Astra agent removed its own safety monitor and denied doing so. OpenAI also found that Astra covertly underperformed on safety research, completing nearly 40 percent less than on matched capability tasks. OpenAI claims overcaution is the likeliest cause rather than scheming, but concedes it can't rule out hidden motives. Researchers have branded the behaviour "sandbagging".

These frontier concerns, coupled with the "Black October"—seguing into Black November—tide of AI-enabled cyber vulnerabilities, should certainly be galvanising Australia to prioritise safety and security.

Our take on today's news

The Albanese Government's announced safety and security measures are laudable in their ambition, but we need more detail on how they'll work. In particular, how do Australian rules apply to the development of AI in the United States, let alone China? Mandating that companies "maintain security controls across all stages of development and deployment" and "identify and manage serious risks associated with their models" assumes that Australia can set the standards for research, training, development and testing in the United States. That seems quixotic in the present circumstances, given the Trump administration continues to balk at forceful AI regulation.

Similarly, if Australia requires frontier companies to "allow independent evaluation of their models", those companies might simply decide not to release those models here. This is no criticism of Government but rather a reflection on the inherent challenge of one country trying to set the standards on a technology whose growing power reaches every corner of the earth but is overwhelmingly owned and built in just two superpower nations. It might be that by matching the more ambitious safety measures in jurisdictions such as California, Australia contributes to gradually building global standards and norms piece by piece. That's worth doing; we shouldn't think it's enough just yet to stop a more harmful successor incident to Hugging Face and Medicare, should that reach our shores.

The 18 recommendations of the federal departments and agencies that carried out the rapid review into the Medicare breach are considerably more muscular and in fact constitute a helpful blueprint of immediate steps Australia should take. There's a clear logic: Australia encourages more AI development here, builds its leverage, advocates globally for better safety standards, strengthens its connections with the industry and boosts the power of the AI Safety Institute. It also imposes practical demands on companies such as prompt reporting of incidents and initiates a thorough cyber clean-up with federal departments and agencies tightening their cyber defences and shutting down old internet-facing systems that create more risk than value.

With AI research automation making demonstrable gains towards RSI, and with AI-enabled cyber risks on the rise, there is not a day to lose in enacting strong, workable safety measures. Without credible safety and security protections, the public mood against AI and the infrastructure to support it will only sour further. Albanese is quite right to say that trust follows safety. A collapse in trust that pushes AI development away from Australia to other countries is not in this nation's interests.

Other news this month

• US agencies set out ten practices for incidents where AI systems "do not act as intended or authorized" during training and evaluation. The voluntary guidance from NIST, the NSA and CISA covers how labs should prepare for, detect, contain and recover from such incidents, and when to notify government.
• The Reserve Bank warned AI could "worsen the cyber threat landscape before defensive capabilities are fully developed". Assistant Governor Sarah Hunter also flagged financial markets' growing exposure to the AI investment boom, in a speech on how cheaper "intelligence" will change the economy.
• The Digital Duty of Care Bill passed the House, amended to cover material that "simulates emotional intimacy and encourages or fosters a child's dependence on it in place of human relationships".
• Australia's AI Safety Institute gets only $7.5 million a year. "The $7.5 million figure is nothing compared to what other countries are throwing at this," said Janet Egan, a former staffer in the Prime Minister's office who now researches AI in the US. The UK institute spends about $125 million a year.
• Anthropic's draft US bill would let the US Government block a model only for a "foreseeable, imminent risk of more than $1 billion in damages, or of killing or seriously injuring more than 50 people", and would override some state AI laws. Transformer's Shakeel Hashim called it weak enough to make Anthropic's "safety-first pitch ring hollow".
• China proposed export controls on frontier model weights, covering models trained with at least 10^26 operations, with at least 2 trillion parameters, or ranked in the global top 10.
• India's cyber agency warned that lab AI agents had reached Indian organisations, and said it learned of the activity from the labs.
• An OpenAI employee was charged over covert recording at the company's headquarters.
• Fracturing within the Coalition on AI copyright. "I'm totally opposed to copyright changes and most of the party room doesn't support it," David Littleproud told colleagues.
• Government was warned it is "sleepwalking into another Robodebt scenario" over its use of algorithms and AI.
• One in 15 Australian adults has experienced AI-generated image abuse, an RMIT study found.
• Russia and the US are seeking to block binding rules on autonomous weapons ahead of a UN review conference.
• Gene synthesis screening: our new report sets out how Australia could screen DNA orders, as the White House updated US screening policy and the UK launched an AI Biosecurity Lab.

—

Model releases

• 13 Oct: Google Gemini 4 Argon (public) – Google "cannot rule out" the unmitigated model approaching its cyber and biological risk thresholds; SecureBio ranks it second of 97 models on biology capabilities. (announcement; reviews: Zvi Mowshowitz, SecureBio)
• 15 Oct: Meta Muse Spark Open (open weights) – Meta calls it "the most capable US open-weight model to date". We found no independent safety evaluation. (model card; review: Nathan Lambert)
• 23 Oct: Moonshot Kimi K3.1 Pro (open weights) – Moonshot held back offensive cyber capability "by design", but SecureBio found it refuses only 33.6 percent of hazardous biology prompts, and Moonshot has published no system card. (announcement; review: SecureBio)
• 26 Oct: OpenAI GPT-6.1 Terra (public) – OpenAI says it "meets the Critical threshold in cybersecurity". (system card)
• 28 Oct: Google Gemini 4 Carbon (cyber defenders only) – Google says it is taking part in the US Government's voluntary pre-release testing. (announcement; review: Zvi Mowshowitz)
• 29 Oct: Mistral Large 4 (open weights) – Mistral says it advances "the frontier of open models in agentic coding and cybersecurity". (announcement)
• 5 Nov: OpenAI GPT-6 Cyber (approved customers) – rated "Critical" for cyber. Irregular "observed no successful attacks on fully hardened targets". (system card; review: Irregular)
• 9 Nov: Anthropic Claude Fable 5.2 (public) and Mythos 5.2 (vetted organisations) – first on Artificial Analysis's intelligence index. UK AISI found it "significantly more capable of evading an action monitor than past Anthropic models". (system card; review: Artificial Analysis)

—

Featured opportunities

• Submissions: South Australia's Royal Commission into AI is taking submissions on its scoping paper. (Closes 30 November)
• Event: Recent developments in AI catastrophic risks and how Australia can chart a safer way, an online panel with Good Ancestors' Greg Sadler and ACT MLAs, run by PauseAI Australia and the Conservation Council ACT. (24 November, 12–1pm AEDT)
• Event: AI Safety Unconference, a one-day, application-only unconference in Melbourne for people working on AI safety in Australia and New Zealand. (27 November; applications open)
• Event: Alignment After Hours: AI Safety Meetup #2, a networking night at the Sydney AI Safety Space during NeurIPS conference week. (11 December, 7–9.30pm)
• Event: AI Safety Forum 2027, two days at the University of Sydney on Australia's role in AI safety and governance. (6–7 July 2027)

—

That's all, for now!

If you'd like to share any relevant news items, discuss AI governance, or learn how you can support our policy work, please reach out.

Onward in action!

The Good Ancestors team