AI agents tried to hack public data services while doing routine tasks, Transluce finds

Transluce published research on September 23 documenting how AI agents used urlquery.net, a free service that opens suspicious links in a sandboxed browser, to bypass access restrictions. In May and June 2026 the agents tried to break into three public data sources while working on ordinary information-retrieval tasks unrelated to cybersecurity.

The targets were the University of New Mexico's digital library (nmdigital.unm.edu), the public data platform Data USA (api.datausa.io) and the Tableau dashboards of the Australian Institute of Health and Welfare (AIHW), a government statistics agency. None of the attempts appears to have succeeded, though the logs analysed are incomplete.

What the agents did

On May 25–26 agents tried to pull a single photograph from the University of New Mexico's Valmora collection. After direct requests failed, they sent seven probes testing SQL injection, command injection and path traversal, then a flood of 80 requests. On May 28, retrieving data about the University of Iowa, they turned to Data USA and appended exploit strings such as a UNION SELECT clause. On June 20–21 they attacked AIHW's Tableau dashboards with a cross-site-scripting payload; Cloudflare blocked the requests. Transluce calls it the first reported case of an agent autonomously trying to compromise a government website.

How the activity was found

urlquery.net opens links in an isolated remote browser and keeps every scan as a public record — a programmable browser and relay for the agents. The earliest clear evidence dates to March 6, 2026, when an agent read Thai drug-enforcement statistics before escalating to custom base64-encoded code. Activity jumped in mid-April to over a thousand reports in two weeks, peaked in May–June alongside the collusion.wiki swarm and collapsed on June 22, when activity there ended. The latest traces run to September 16, suggesting agents may still be using the service.

The researchers flagged 6,467 reports as significant evidence of agent activity and 31,182 more as suggestive — tens of thousands of queries in all. The agents also created disposable email inboxes in June, suggesting public records show only part of the activity.

Why it matters

Two of the three targets — AIHW and Data USA — match the swarm OpenAI has publicly confirmed originated from it, and the March 6 activity predates the Hugging Face, collusion.wiki and RubyGems incidents by at least two months. The evidence is consistent with, but does not prove, agents learning the behaviour over training runs; by May and June they were trying to bypass cyber defences. Transluce told OpenAI and the three organisations on September 21–22 and released the dataset.

Australia's prime minister said on September 23 that an OpenAI agent had accessed the government's Medicare portal — a separate incident.