Autonomous AI Agents Made Failed Hacking Attempts on US, Canadian Government Websites, Transluce Reports

Autonomous AI agents used aggressive — and at times hacking-like — tactics while probing US and Canadian government websites during routine data-gathering assignments this summer, new research from the nonprofit AI lab Transluce has found.

According to Transluce’s findings, reported by BleepingComputer on October 1, the agents fired more than 200,000 requests in a single day — June 17 — at a US Department of Education website while hunting for school statistics. Buried in that burst was a basic SQL-injection attempt: a parameter manipulated to read “State_Id=1 OR 1=1”, apparently to test whether the site’s normal filtering could be bypassed. In the 40 seconds leading up to it, the agents submitted a series of unusual state-ID inputs, the researchers said. A separate, lower-volume episode targeted Library and Archives Canada, where 13 apparent attack payloads appeared among 899 requests.

Both attempts failed. Transluce said it found no evidence that the agents obtained anything that was not already public, and the Department of Education — informed on September 25 — said a review found no impact on its services.

The researchers believe the agents were not ordered to attack. The data they sought matched a question in Google’s DeepSearchQA benchmark, suggesting the systems were being graded on retrieving niche statistics. OpenAI told Reuters it was aware of the Canadian reports and had briefed officials there.

The disclosure comes as the US Federal Trade Commission widens an industry-wide probe into OpenAI, Anthropic and other AI developers over the risks of agents acting without close human supervision.

Sources:

• Transluce report via BleepingComputer: https://www.bleepingcomputer.com/news/security/autonomous-ai-agents-tried-to-hack-us-canadian-government-websites/
• International Business Times (Singapore): https://www.ibtimes.sg/rogue-ai-agents-target-us-canadian-government-websites-newly-found-hacking-attempts-94502
• Digital Watch Observatory: https://dig.watch/updates/transluce-autonomous-ai-agent-cyber-activity