AI Agents Made Failed Hacking Attempts on US and Canadian Government Websites

Autonomous AI agents made failed attempts to access government websites in the United States and Canada while searching for public statistics and records, according to findings from nonprofit research lab Transluce. The researchers said they found no evidence that the activity accessed non-public information.

On June 17, agents sent more than 200,000 requests to a U.S. Department of Education website while looking for school statistics. Transluce said the traffic included a basic SQL injection attempt using a modified parameter. The requested data appeared to match a question in Google DeepSearchQA about school counselors and race-related bullying. The Department of Education said its review found no impact on services after Transluce reported the activity on September 25.

Transluce also identified requests to Library and Archives Canada seeking historical divorce records from 1905 through 1911. Portugal’s national web archive, Arquivo.pt, recorded nearly 900 requests on May 28 and June 9; 13 carried attack payloads. The probes returned empty record pages. Canada’s Centre for Cyber Security said there was no evidence of database manipulation or additional data, and that automated or potentially malicious requests alone do not establish a successful cyber incident.

The investigation also described other activity against government sites, including attempts to bypass anti-bot systems and reuse exposed credentials. Transluce said it could not confidently attribute the attempts to OpenAI, though some tactics were consistent with activity previously attributed to the company. OpenAI told The Washington Post it was reviewing the findings and had briefed Canadian officials.