Australia says OpenAI waited nearly three months to disclose the breach and is investigating whether the company could face criminal charges.