Our new Policy Paper Series translates behavioural science research into practical insights for policymakers, industry, and the broader community. The series showcases evidence-informed approaches to addressing real-world challenges, providing accessible analysis and actionable recommendations that support better decision-making and the effective adoption of new technologies.

Title: AI can find the flaws. But who will pay to fix them?  

Authors: Steve J. Bickley and Benno Torgler

Abstract: The October 2026 PHP security emergency illustrates a growing challenge for digital government. AI-assisted researchers reported a critical vulnerability more than ten weeks before patches became publicly available Premature disclosures then revealed information that could help attackers before users could update, while precautionary shutdowns disrupted government services even without confirmed breaches. The problem is not simply that AI makes vulnerabilities easier to discover and exploit. It is that discovery, expert remediation and secure deployment operate at different speeds. Australia should make maintenance obligations verifiable in procurement, pool funding for critical shared components, and fund the capacity to test and deploy fixes. AI investment should include these continuing costs across the software lifecycle.