BLEICH, Mr Jeffrey, Special Envoy, Anthropic [by audio link] HALE, Mr Charlie, Head of Product Policy, Anthropic MASTERS, Mr David, Head of Policy Australia and New Zealand, Anthropic ORR, Mr Dave, Head of Safeguards, Anthropic [by audio link] [12:18] CHAIR: I now welcome representatives of Anthropic to give witness to us today. I understand that information on privilege and the protection of witnesses giving evidence to this inquiry has been provided to you. I now invite you to provide a very short opening statement—if there's anything further that you want to provide in writing to the committee, you can do so through the secretariat—and then we'll move to questions. Mr Bleich : Thank you very much, Madam Chair and honourable members of the committee, for this opportunity to appear here today. We've tabled a statement. I won't read that entire statement; I'll just give you an abbreviated version. I do want to mention again that Dave Orr is here to lead our safeguards team that builds the safety technology; David Masters leads policy for Australia and NZ; and then, finally, we've got one colleague—who's not named David!—Charlie Hale, and he's a member of our policy development team. As you know, I've spent a significant part of my career thinking about Australia and the United States—about our alliance, about our shared goals. Today, the world's most advanced AI systems are being built principally in two countries: the United States and China. Yet their consequences are already being felt everywhere on the planet. There's a fundamental question now before Australia and the other most advanced allied democracies in the world: will they help set the terms on which this technology develops, or will they allow those terms to be set for them? Australia is a very strong democracy, a trusted ally of the United States and a really important middle power with a record of leadership on digital safety, so we're very grateful to the members of this committee for stepping up to confront this question for the people of Australia. It reflects once again that Australia's leaders recognise the choice before them and how much it matters and are prepared to step up to it. We hope Australia will seize this opportunity to become a place where frontier AI is not simply consumed but also developed and developed safely and responsibly. Anthropic really wants to be a long-term partner in that effort. The economic opportunity for Australia is already very significant. Australia's already one of the world's most intensive adopters of AI, and your Productivity Commission estimates that AI adoption would deliver an additional $116 billion in GDP over the coming decade. That includes investment in AI accelerated research for the public benefit, which brings forward investment in the renewable energy transition and creates regional jobs that contribute to Australia's tax space. Hosting the infrastructure to train frontier models here is going to also attract high-end research capability and talent that supercharges the domestic AI ecosystem and builds a greater sovereign capability for all Australians. We want to be helpful to Australia in forging a system that serves Australia, allows it to gain all these benefits and allows it to expand its own sovereign AI capability to the very frontier. The countries that host the training of frontier AI systems now are going to shape the capabilities, behaviours and safety properties of the AI that the rest of the world is going to depend on. Australia can host that activity here under its own laws, with its own conditions attached, or it can import the outputs of training that happen elsewhere. This is really a question of critical infrastructure, and we think it should be treated that way. For Australia, I think that means ensuring that you have access to capable systems from trusted partners and the ability to train, run, evaluate and secure those systems under Australian law and on local terms. This effort is global in its implications and national and local, and we would work with you across all those dimensions, in particular, with regional communities. That includes how and where we would build data centres with you. Working together also means being clear eyed about risk. AI is becoming more capable, and the consequences when powerful systems are misused or inadequately controlled can be very serious. Recent incidents have just reinforced that some of these risks are no longer theoretical. As increasingly capable AI systems interact with sensitive information and with consequential decisions, the safeguards that we have around frontier AI need to advance alongside the technology itself. That's what Anthropic means when we talk about pacing the frontier. There really should be no trade-off between capturing the opportunity of AI and taking those risks very seriously. Australia can and should do both. We can and we do both. If Australia takes this opportunity and gets the balance right, it will not simply participate in the AI era; it will shape it. Our work, like the work of this committee, is to get AI right, not just for today but for the benefit of future generations. Thank you very much for granting us this opportunity to appear today. My colleagues and I look forward to answering your questions. CHAIR: Thank you. I'll kick off. Off the back of the evidence that we've heard this morning, there is clearly a pretty big live public debate around whether you're asking us to seek to soften copyright protections in order to accommodate the training that you refer to being able to come here. Can we get some clarity from yourselves directly on what it is that you're willing to commit to around a remuneration framework for Australian creators as part of how you scale here and on what timeframe we could expect that or see that in practice. Mr Bleich : I will probably defer to my colleague Charlie Hale on copyright issues, but, just generally, we've never tried to dictate to Australia the terms here. What we have done is share information about how training works and then discuss what its implications would be with respect to our capacity to operate here. We will do inference here, because it's now clear, from us regarding Australian law, that there would be no issue under Australian law or international copyright law. But training creates a different situation. We've been honest about that and what we can and can't do. There are certain things that are just technically impossible to do. You can't license the entire internet. Billions and billions of information exists there which is available to be viewed and studied, and that's essentially what training is. Training is not copying and making reproductions of people's works or reproducing or regurgitating them. Training is about looking at documents and identifying styles and ways of processing information—what words typically follow other words in various writings—and gathering that together, just as a human being would read lots of books and then form their own ideas. The responses are not determinative, and we don't reproduce other people's works. But, under existing Australian law, it's our understanding that that could be determined to be illegal if we weren't able to find a licence with every single person who had rights within Australia that could be enforced by law. That's the nature of the conversation that we've had in terms of trying to better understand how we can be a good partner to you. With that, I'll turn it over to Charlie, who can give you some more detail about that. Mr Hale : Jeff covered it pretty well; he basically said everything that I was going to say. Just to echo what Jeff said, our understanding is that the Australian government has said that it is interested in exploring what would be necessary to incentivise training here, that that would be done on Australian terms and that there would be conditions that would come along with that. As Jeff alluded to, we are very open to understanding what those conditions would be, to giving feedback on it and to sharing experiences that we've had from building models in the US, because obviously things like the legal certainty that we have there is something that I'm sure and I know you are all grappling with. I guess I would say, just to be very clear, that we do not think that Australia should take the system that exists in the US and copy and paste it. Again, like I said, we know that Australia will have its own conditions and expectations and ways that, if you do want training here, you would need to develop that, so we're open to giving feedback on it. Mr Bleich : If I can just add a couple quick points on that, Australia explained that it didn't want to move forward with the TDM exception, and we haven't thought about that. We accept these judgements. We respect the dignity of the creative community of Australia, and we want them to be successful. The current system has incented companies to operate outside of Australia, which reduces the capacity for any sort of control or capacity to share in specific benefits that come with training, whereas if the government were to find a way to allow training in Australia, consistent with its laws, then we've already talked about ways in which creatives would be able to control whether material was used in training, either by notifying us that they didn't want it to be used in training or by using CAPTCHAs, robots.txt or other existing technical safeguards. The goal here is to be a good partner, to be a good neighbour and to be supportive of the community, the values and the culture of Australia, so we have worked to be flexible and to listen to ideas that the government generates and try and see how we can work within them. CHAIR: I have one final question, and then I'll open it to fellow committee members. I also appreciate the time sensitivities that we have here. The next question is on safety. I appreciate some of the contributions you've already made, but the OpenAI incident with Services Australia is obviously front of mind for this committee. Could you walk us through what specifically obliges Anthropic to notify the Australian government if one of your models, or an agent built on it, behaved in a similar way? Is there a formal commitment to the government, or does it currently sit within your own internal policy? Mr Masters : Dave, do you want to take that one? Mr Bleich : Do you want to go, Dave? Mr Orr : Yes, sure. My understanding is that it is probably controlled by Anthropic internal policy right now, but our policy is that we do notifications to victims of this sort of thing and certainly would to the Australian government as soon as we detected anything of that nature. We would definitely reach out within a matter of days, or sooner, as soon as we understood the details. We would be very happy to work with your team to understand the extent of exactly what happened and fix any issues or vulnerabilities that were revealed or caused. Mr Bleich : We have pioneered responsible scaling policies and promoted regulation to ensure transparency and that incidents are reported and that we have a safety plan that's also transparent. We currently issue a misuse report on a regular basis, and we will continue to try and be good partners in helping explain the risks and identify them. But again, as Dave said, right now this is largely voluntary when we're still learning the technology and learning how to conduct investigations as well. Mr Masters : Yes. If I can just add to that, there are transparency requirements in some laws, particularly in California, that do require notification of critical safety incidents, and we would welcome similar laws here in Australia, to clarify that. CHAIR: Thank you very much. Mr Hastie, do you have any questions? Mr HASTIE: Yes. Thanks for appearing today. I have a question from your submission, about compute and energy. AI is very energy intensive. On page 3 of your submission, it states: Our preference will be to match that generation— talking about energy generation— with new renewable supply through long-term power purchase agreements for wind, solar, and storage projects. Are renewables alone enough to power the AI revolution here in Australia, assuming that Anthropic invests here and at scale? Mr Masters : One of the reasons we're very attracted to Australia as a destination for compute investment and data centres is the incredible pipeline of renewable investment. Energy generation is a matter for state governments, for power generators. When we plug into the grid, we want to ensure we are adding to the grid in a way that promotes stability—so new renewable generation but also ensuring that there's appropriate firming. There is a role for gas as part of that, but our preference is very much for renewables. Mr HASTIE: Is it true that, in the United States, there is a shortage of gas turbines and there is a long queue of companies waiting to purchase gas turbines for their data centres? Mr Masters : I can't comment on the situation in the US. I know there is a very strong demand for power to power data centres in the US. Mr HASTIE: Your Anthropic colleagues have published extensively on how easy it is to inject poisoned data into the AI model supply chain and how hard it is to detect, let alone eradicate. What can you tell us about trusted and untrusted AI model vendors in relation to Chinese models, which you published on last week, and what are you doing to ensure you can maintain your own trusted status? How do you secure your supply chains, and what does that mean for the importance of security and integrity requirements when you set up in Australia? Mr Orr : Model poisoning in general is a research area. There's research work within my team to understand it. We publish in this space. It's a little hard to say anything too definitive about a brand-new research area. However, we have identified a few areas that seem especially concerning and have started to put into place mitigations for this. We have classifiers—automated systems that review any documents before they are added to our pre-training corpus. Pre-training is the first phase of training where very large amounts of information—basically every publicly accessible document on the internet—are added. We scan this for poisoning, and we have found some attempts—maybe some unintentional things but some things that look like governments intending to convince the models to answer propagandistically in their particular language. The second phase is post training, where we licence lots of data from supply chains—for instance, from vendors. We have standards for them. We have a quality assurance process which involves automated systems and sometimes human inspection to ensure that these are high quality and don't contain any kind of malicious content. I don't think there's anything special that would need to be done with regard to Australia in particular but I would welcome any thoughts in that direction. Mr Bleich : In addition, not specific to data poisoning but more generally in terms of how we think about supply chains, we've famously turned away work and billions of dollars worth of contracts that were offered to us from companies, simply because they were under the influence of the Chinese government. We want to maintain a secure supply chain generally. One of the attractions of working with Australia is precisely that—the strong supply of critical minerals available in Australia. It is another way in which we would be investing in Australia to secure the supply chain and the integrity of the outputs from AI not only for us but for Australia and the rest of the world. Mr HASTIE: Thank you. CHAIR: Ms Chaney. Ms CHANEY: Firstly, if Australia were to consider a mandatory incident reporting and monitoring requirement on frontier AI developers, what considerations do you think would be important? Mr Masters : I think a key one is to ensure that it's interoperable. We've seen, particularly in cyber, that, where there are a set of non-interoperable standards operating, it does add additional operational complexity. It's incumbent on ensuring that we get the information in the fastest possible way to the people who need that information. If we're having to deal with a web of different regulations around the world, that adds complexity, and I think it does actually slow down our ability to meet those requirements in the markets we operate in. So interoperability is a key one. There are some good examples. I mentioned the California law SB-53; it is a good example that Australia could follow, with some of those transparency and reporting requirements. Ms CHANEY: Thank you. My other question is about biological risk, and I understand that's changing quite rapidly. Can you talk about the potential risks that we're seeing from a biological perspective and maybe also speak to the open letter signed by your CEO and others asking for the mandating of screening of synthetic genetic material orders and whether Australia should also be looking at that. Mr Orr : Biology capabilities of the models are increasing quite rapidly. This is great because it will hopefully allow for a lot of beneficial biology and research work. We at Anthropic are sponsoring a large amount of beneficial biology research. But it also comes with risks. Biology is dual use. An engineered pandemic is one of the scariest things that you could imagine, so we've built very strong safeguards of various kinds to ensure that this doesn't happen. It is, of course, not enough to only secure the outputs of Anthropic's AIs. There needs to be a much broader and coordinated effort for all kinds of bio misuse risks. I am not personally a deep expert in bio supply chains, although I do have people on my team who are. I would personally be strongly in favour of ensuring that anywhere that you could send in DNA and get back an arbitrary protein or virus be secured. But I'd be happy to take on notice the question here and provide more detail, from the actual experts. Ms CHANEY: That would be great. Mr Masters : The only thing I'll add to that is that I think there is a key role for Australia in this. Australia has a long history of export controls and leading global momentum around controlling the use of technologies appropriately in the biological space, particularly with the Australia Group and other forums. It probably is an area Australia could play an outweighed position in. Mr Bleich : This is a significant national security question for us. Again, one of the attractions to us of working together in Australia is precisely that—the long history of trust, information sharing and interoperability between our nations. Ms CHANEY: Thank you. Lastly, how confident are you that your models haven't breached Australian government websites? Do you have visibility over significant breaches by private individuals or organisations through use of your models? Mr Orr : We have been running a lengthy, deep investigation in the wake of the Hugging Face disclosures to try to understand everything that we possibly can about how our models have been acting and whether they have, in an unauthorised way, accessed networks. This has involved reviewing hundreds of millions of transcripts, mostly with AI systems. We have not found any cases where it interacted with Australian government systems in some sort of unauthorised way. We haven't found anything like this, and we have looked. We have much less visibility into what is happening for our customers, and the reason for that is that a lot of customer usage is in what's called zero data retention, where we do not store copies of their exchanges, their prompts and their responses. This is something that is very commonly demanded by enterprise customers and is standard. We've been working toward retaining more data so that we can run investigations if we need to. But, for the majority of our historical usage by customers, that usage is in ZDR, so we can't look through it and determine if anything like this happened. CHAIR: We're going to suspend the proceedings. Proceedings suspended from 12:45 to 13:59 .