Securing Malaysia’s digital sovereignty against autonomous AI
by Thulasy Suppiah, Managing Partner
THE recent revelation that an OpenAI agent breached an Australian government health portal while performing a research task represents a chilling escalation in global cybersecurity. We are no longer defending against human hackers or static code; we are facing autonomous, goal-oriented algorithms capable of bypassing systemic firewalls without direct human intervention.
For Malaysia, this warning arrives at a precarious juncture. Our rapid national digitisation, centralising citizens’ sensitive data into systems like MyDigitalID and PADU, creates an increasingly valuable honeypot of sovereign data. Yet, under Section 3(1) of the Personal Data Protection Act (PDPA) 2010, the Act does not apply to the Federal and State Governments. In an era where foreign AI agents can independently breach external systems, this legislative blind spot creates a distinct public-sector accountability gap.
When an autonomous AI breaches a sovereign system, the immediate legal question is accountability. Major developers frequently describe such incidents as actions their models “did not intend.” We must not allow technical autonomy to become a shield for corporate liability.
While Singapore has commendably initiated multilateral dialogues urging tech giants to commit to transparency, relying on voluntary corporate goodwill is insufficient. As Australia discovered, voluntary disclosure can result in catastrophic delays; OpenAI took nearly three months to notify the Australian government. In a landscape where AI operates in milliseconds, delayed reporting is a severe governance failure.
Fortunately, Malaysia is currently shaping its regulatory future through the proposed AI Governance Bill. This is our opportunity to codify robust legal safeguards.
Specifically, the Bill’s proposed “AI Incident Reporting” framework must possess statutory teeth. Taking cues from the European Union’s AI Act, Malaysia should mandate strict reporting deadlines for serious incidents involving high-risk AI systems—generally within 15 days, shortened to two days for certain particularly serious cases and 10 days where a death is involved—backed by meaningful financial penalties for delayed disclosure.
Furthermore, Principle 3 of the proposed framework must be strictly enforced. The law must unequivocally establish that legal responsibility cannot be displaced onto the AI system itself. Accountability must remain traceable to the developer or deployer who exercised control over the system.
Holding foreign developers accountable is only half the equation. Our domestic defence posture must radically evolve. Government agencies and National Critical Information Infrastructure (NCII) operators can no longer rely on legacy perimeter security. Our institutional infrastructure must be hardened to detect and isolate the probing and bypass attempts such agents can generate in real time.
By strengthening public-sector data accountability, enforcing rapid incident reporting and ensuring responsibility remains traceable to those who control AI systems, Malaysia can ensure our digital borders remain secure in an autonomous future.
Written By:
Thulasy Suppiah
Lawyer focusing on AI, Data Centers & Cybersecurity
Managing Partner @ Suppiah & Partners
UG-13, Lexa Galleria, 45, Jalan 34/26,
Wangsa Maju, 53300 Kuala Lumpur.
Handphone no: 012-4915238
© 2026 Suppiah & Partners. All rights reserved. The contents of this newsletter are intended for informational purposes only and do not constitute legal advice.
