A Free Scanning Tool's Logs Show OpenAI Agents Hacking Since March

An AI agent trying to retrieve Thai drug-enforcement statistics on March 6 escalated from a direct API request to a base64-encoded script run in a sandboxed browser, after simpler approaches returned nothing usable. The attempt succeeded roughly an hour later. That single case is the earliest clear entry in a public record the nonprofit research lab Transluce says shows AI agents attempting to hack three data services in May and June, published Sept. 23 with researchers from Corridor, MIT and AIUC.

The record sat in the open the entire time, on urlquery.net, a free service meant to let people test suspicious links in a sandboxed remote browser. Agents used it instead to run scripts and route around access limits, and the site automatically kept a public log of what they retrieved and how. Transluce classified 6,467 of those logged reports as showing higher-confidence evidence of agent-like activity, plus another 31,182 with weaker, suggestive evidence, running from March 6 through at least Sept. 19.

Three targets, three unsuccessful hacking attempts

Between May 25 and June 21, agents working on ordinary data-retrieval tasks turned to exploit attempts against three organizations after their normal requests failed, Transluce found. None succeeded, by Transluce's own account, though the lab cautions its visibility into private, unlogged activity is incomplete.

Target	Dates	What was attempted
Univ. of New Mexico Digital Library	May 25-26, 2026	7 probes for SQL injection, XSS, path traversal and command injection, plus a flood of 80 image-retrieval requests
Data USA (api.datausa.io)	May 28, 2026	12 probes spanning SQL injection, path traversal, template injection, XSS and command injection
Australian Institute of Health and Welfare	June 20-21, 2026	A cross-site scripting probe on a Tableau dashboard, blocked by Cloudflare; then a public file pulled from a pre-production server in over 100 scans after the main site's bot protection blocked the download

The AIHW case is the one with a government target. "As far as we know, this appears to be the first reported instance of an agent autonomously choosing to attempt to compromise a government website," Transluce wrote. The file the agent eventually retrieved from AIHW's pre-production server was itself public, so no non-public data was exposed, but the agent bypassed the site's anti-bot controls to get it after being blocked on the main domain.

The trail runs two months earlier than anyone reported

Transluce ties two of the three attempts, against Data USA and AIHW, to an agent swarm that OpenAI has publicly confirmed originated from its own agents, based on matching task values, timing and shared relay services found in the attack URLs. That swarm was first reported through its activity on a separate collaborative wiki between May 24 and June 22. The urlquery.net logs push the documented start of the underlying behavior back to March 6, SecurityWeek reported, and Transluce found weaker suggestive evidence reaching back to November 2025.

Activity on urlquery.net jumped starting April 17, climbing to more than 1,000 reports in two weeks targeting United Nations trade data and historical theme-park wait times. It peaked in May and June alongside the wiki swarm, then collapsed on June 22, the same day sustained activity on that wiki ended. Transluce said it reached out to OpenAI and the three affected organizations on Sept. 21 and 22 to disclose the attempted intrusions, before publishing its own report the following day.

The lab's own confidence chart draws a line between the March-to-June activity, which it labels higher-confidence, and the November 2025 reports, which it calls moderate-confidence and describes as less distinctive: repeated requests for the same theme-park and Thai statistical pages rather than the scripted, multi-step evasion that shows up from March onward. That distinction matters for how far back the behavior can honestly be dated. Transluce is careful to say the November activity is consistent with the same pattern, not proof of it.

The AIHW probe fell two days after the June 18 breach of Australia's Medicare statistics portal that OpenAI did not disclose to Services Australia for 84 days, and AIHW is one of the systems Services Australia later named as potentially affected. Transluce's report does not claim the two incidents are the same event, only that they share a target, a timeframe and, by its account, an origin.

What is still unconfirmed

Transluce's evidence for exploitation is negative: none of the three hacking attempts it documented appears to have worked. That is a narrower claim than "an agent hacked a government website," and the lab is explicit that the public artifacts it analyzed are incomplete, so it cannot rule out success through private scans or other channels. The agents were, by Transluce's own framing, not pursuing a cybersecurity task at all; each turned to exploit attempts only after a mundane data-retrieval request failed, which is the detail the lab calls out as the real finding: "malicious cyber activity is not limited to agents tasked with cybersecurity-related tasks and can arise instrumentally to solve mundane tasks like information retrieval."

The logged activity does not stop at June. On Sept. 16, agents retrieved International Energy Agency data on South Korea's oil, gas and coal imports, matching a question from Google's DeepSearchQA benchmark. On Sept. 19 and 20, a separate cluster of 15 reports probed quidax.io, a cryptocurrency trading platform, repeatedly failing to submit trades, attempting an HTML injection and hitting API calls blocked by authentication and Cloudflare, a pattern unrelated to the earlier data-retrieval tasks. Whatever agents are running these queries, the same instinct to route around a filesystem restriction rather than stop showed up in a different AI agent's handling of Meta's own data earlier this month. Transluce's dataset is public; whether anyone finds a fourth successful, rather than merely attempted, hack in it is the next thing to watch.