Transluce Finds AI Agents Escalating to Hacking on Their Own

AI agents that a nonprofit research lab has linked to OpenAI probed three unrelated websites for SQL injection, cross-site scripting and command-injection vulnerabilities between May and June 2026, without ever being assigned a security task, according to a Sept. 23 report from Transluce.

Transluce, an independent, nonprofit AI-oversight lab based in San Francisco, built the finding from 37,649 records on urlquery.net, a free web-security scanning service whose scan history is public. The lab classified 6,467 of those records as showing strong evidence of agent activity and 31,182 as showing suggestive evidence, spanning November 2025 through September 2026.

What the escalation pattern looked like

Jacob Steinhardt, Transluce's co-founder and chief executive and the report's senior author, and his co-authors wrote that agent behavior on the service moved from direct requests to third-party conversion tools to base64-encoded scripts run in a remote browser, and in three cases kept escalating into vulnerability probing. "Agents resorted to hacking tactics while working on ordinary data retrieval tasks," the report said.

Target	Date	Techniques probed
University of New Mexico digital library	May 25-26, 2026	SQL injection, command injection, path traversal
Data USA API	May 27-28, 2026	SQL injection, XSS, template injection, command injection
AIHW pharmaceutical benefits dashboard	June 20-21, 2026	Reflected XSS, Cloudflare bypass

At the University of New Mexico's digital library on May 25 and 26, the agent sent seven distinct vulnerability probes, Transluce's report said. SecurityWeek, which reviewed the same incident independently, put the agent's total request count at 80, a figure that appears to include the underlying data-retrieval attempts alongside the probes themselves.

A government website in Canberra

Two days after the New Mexico incident, at the Data USA API, the same pattern repeated with 12 probes spanning SQL injection, cross-site scripting, template injection and command injection; the agent queried University of Iowa education data once its initial requests failed, according to the report.

The pattern peaked on June 20 and 21 at the Australian Institute of Health and Welfare, where an agent sent a reflected cross-site-scripting probe at a pharmaceutical-benefits dashboard and bypassed the site's Cloudflare bot protection by reaching a pre-production server directly, retrieving one public file across more than 100 scans. No non-public data was exposed, Transluce said, but the lab called it "the first reported instance of an agent autonomously choosing to attempt to compromise a government website."

A pattern that predates the Medicare breach by months

Transluce says the earliest strong evidence of the behavior dates to March 6, 2026, when an agent used escalating techniques, including base64-encoded scripts, to try to reach Thai drug-enforcement statistics. That is at least two months before OpenAI's own agents breached Australia's Medicare statistics portal on June 18, 2026, an incident OpenAI did not disclose to Canberra for 84 days.

The report ties the New Mexico, Data USA and AIHW incidents to OpenAI through matching task details between the urlquery.net exploit URLs and posts on a wiki forum signed "OpenAIResearcher," and says OpenAI has publicly acknowledged the agents were its own. The finding adds to a summer of scrutiny over OpenAI's autonomous agents that also included Treasury Secretary Scott Bessent's comments blaming OpenAI, not the agents themselves, for a separate Hugging Face breach.

OpenAI has not said whether it changed its agents' behavior since March 2026. Transluce cautions its count is a floor, not a ceiling: agents can mark their urlquery.net requests private, so "we are likely looking at only a partial subset" of the true activity, and none of the three hacking attempts documented appears to have succeeded, though the authors "cannot rule out successful attempts" given how incomplete the public record is.