AI in Schools
Canvas breach hits Australian universities and TAFE
Three platform stories today, all about who controls the tech sitting under Australian education and what happens when that grip slips.
RMIT, UTS, Western Sydney and TasTAFE are all investigating exposure to the Canvas breach
Instructure, the US owner of the Canvas learning management system, confirmed on 2 May that "a criminal third party" got into Canvas. By 6 May four Australian institutions, RMIT, the University of Technology Sydney, Western Sydney University and TasTAFE, had told their students they are working with the vendor to check whether their data was caught up in it. The threat group ShinyHunters claims to have hit Canvas across roughly 8,800 schools and universities globally, and is publicly demanding payment to stop the leak. Instructure says the exposed data is limited to names, email addresses, student ID numbers and messages between users, and that passwords, dates of birth, government identifiers and financial information were not involved.
Why this matters: This is a vendor-side incident landing on universities mid-semester, and it lands on institutions that just spent two years arguing about AI in assessment without much air time for the platform sitting under the assessment itself. For pro-vice-chancellors, the operational read is that the exposure is not the data itself (Canvas messages are not the crown jewels) but the social-engineering headroom that names plus course-context creates. Phishing campaigns aimed at Australian students over the next six weeks will look more convincing than usual, and security teams should prime their inbox filters now. iTnews on the affected Australian institutions, Inside Higher Ed on the extortion angle.
NSWEduChat is now the largest state-owned classroom AI deployment in the country
The NSW Department of Education's purpose-built generative AI tool went from a 50-school pilot to system-wide automatic access for every Year 5 to Year 12 student in NSW public schools at the start of Term 4 last year. One full term in, the tool is the only state-owned (rather than vendor-owned) classroom AI assistant operating at scale anywhere in Australia. It runs on a department-controlled model, keeps student and teacher data inside the department, and refuses to give direct answers, instead returning Socratic-style follow-up questions designed to push students through the reasoning themselves.
Why this matters: As the Canvas story shows, vendor risk is now central to the LMS conversation. NSWEduChat is the comparison point every other state will be measured against, and this is the year the data starts to come back from the deployment. For independent and Catholic systems in NSW, the practical question is whether NSWEduChat licensing extends beyond government schools, because the alternative is paying ChatGPT EDU or Microsoft Copilot rates for the same use case. For the rest of the country, watch what NSW publishes from a full school year of system-wide use, because that will be the most valuable AI-in-classroom dataset on Australian soil. NSW Government ministerial release.
Australian universities are quietly walking away from Turnitin's AI detector
Curtin University's January switch-off of Turnitin's AI writing detection feature has now been live for one full semester, with text-matching originality checks still in place. Australian Catholic University ran a pilot disabling the same indicator last year, citing reliability problems and unclear evidentiary value, after handling thousands of AI-related integrity cases that often relied on the indicator as the trigger. The University of Sydney still uses the tool but only as one input among several. The University of Melbourne advises students it is not used to make standalone integrity decisions. Curtin's framing in its 2025 announcement: the change supports "trust and clarity" in a context where AI tools are part of the workplaces students are training for.
Why this matters: This is a sector quietly arriving at the same conclusion at different speeds. Detection-led integrity policies are being replaced by assessment redesign, oral defences, and process-evidence portfolios. For academic integrity officers, the operational read is that the tool is no longer a sufficient defence on its own; the misconduct case has to stand on assignment design and student work history, not on a Turnitin AI percentage. Pro-vice-chancellors who have not yet done the assessment audit are now visibly behind the curve. EdTech Innovation Hub on Curtin's policy shift.
The thread today is platforms. A shared LMS that just leaked, a state-owned AI tool now in every NSW public classroom, and a Turnitin feature quietly being switched off. The platforms underneath the sector are doing more of the deciding than the policy frameworks above them.