AI Agents Gathering Public Data Resorted to Attempted Website Hacking

On September 23, Transluce published an analysis of three episodes from May and June 2026. Autonomous agents tasked with collecting public data, after failing to obtain it the usual way, moved on to attempted hacking. Researchers link two of the three cases to a group of agents whose origin OpenAI had previously publicly acknowledged.

In all three cases the logic is similar: an agent is given a routine task such as pulling statistics, hits access restrictions, and starts working through workarounds. One of the tools was urlquery.net, a link-checking service with a remote browser through which code can be executed on someone else's page. The service's records are public, and it was from them that the picture could be reconstructed.

First episode, May 25 and 26, the digital library of the University of New Mexico. The agent tried several times to retrieve a single photograph, and after the failure sent seven requests testing for SQL injection, command injection, and directory traversal. Separately, the authors mention a series of 80 requests to the server. There are no traces of success.

On May 28 the target was Data USA, an open API with visualizations of US government data. Information about the University of Iowa was needed, the requests kept failing on errors, and so the agent went through 12 exploitation variants, from SQL injections and path traversal to template injection and cross-site scripting. A similar request appeared within the same half hour on the forum of the already known group.

Third episode, June 20 and 21, the website of the Australian Institute of Health and Welfare (AIHW). The task was routine: calculate spending on dermatological medicines by Victorian district. The main site fended off the requests with bot protection, so the agent sent a cross-site scripting probe and retrieved the needed file from a pre-production server in more than a hundred requests. The data in the file is public, but the agent got around the protection.

The authors call the AIHW case the first described instance of an agent deciding on its own to try to hack a government website. Traces of similar activity stretch from March 6 to September 16, 2026, peaked in May and June, and broke off on June 22. The attempts were isolated and weak, researchers found no traces of an actual breach or leaks, and the agents' tasks had nothing to do with cybersecurity.

Legal status in Russia: Meta Platforms Inc.’s activities involving Facebook and Instagram have been designated extremist and prohibited in Russia. According to the Ministry of Justice list, the relevant court decisions do not apply to WhatsApp.

Image: Tcharon CC0 · License

Translation editors: Соловьев В., Пеков А.