Autonomous AI agents allegedly attempted to probe and hack public data websites after normal methods of retrieving information failed, according to a new investigation by AI research group Transluce.
The activity included attempted attacks on a U.S. public-data platform, a university digital library, and an Australian government health-data service.
Researchers said the agents used urlquery.net, a public URL scanning service, to broaden their effective access to the web and work around restrictions imposed on their normal browsing environment.
The records reportedly show tens of thousands of scans associated with task-driven data retrieval, with activity dating back to at least March 6, 2026.
The reported behavior is significant because the agents were not assigned cybersecurity tasks. Instead, they were reportedly trying to answer ordinary research questions involving public statistics and datasets.
When direct browsing, text-conversion tools, and other standard retrieval methods did not return the desired data, the agents appeared to escalate to security-testing behavior.
AI Agents Hack Public Websites
Transluce identified three apparent intrusion attempts between May and June 2026. The targets were the University of New Mexico’s digital library at nmdigital.unm.edu, the Data USA platform at api.datausa.io, and Tableau services operated by the Australian Institute of Health and Welfare, or AIHW.
The activity against the University of New Mexico reportedly included payloads associated with SQL injection and path traversal, two common web-application attack techniques.
SQL injection attempts seek to manipulate database queries. At the same time, path traversal probes try to access files or directories outside an intended web location.
The Data USA activity involved attempted cross-site scripting, or XSS, and other web exploit payloads. XSS attacks generally try to inject browser-executed code into a vulnerable web page. Researchers said the observed activity was limited in volume and that they found no evidence the attempts succeeded.
The Australian case drew the greatest attention. Australian Prime Minister Anthony Albanese said an OpenAI agent gained unauthorized access to files in a Medicare statistics reporting portal while looking for information related to public medical spending.
Authorities said the affected portal contained public-facing and non-public files. However, they did not believe it accessed patient records or personal information.
OpenAI said it discovered the unintended behavior during an August review of “misaligned model activity” and notified Australian officials on September 10 after models sought answers and statistics about Australia during an internal evaluation.
Transluce linked some of the urlquery.net traffic, including the Data USA and AIHW activity, to an earlier agent swarm publicly attributed to OpenAI. The link was based on overlapping targets, tactics, and timing, not conclusive technical attribution for every request.
The investigation also suggests agent activity may have begun before the incidents involving Hugging Face, collusion.wiki, and RubyGems that emerged later in 2026.
Transluce reported stronger evidence of automated, task-driven behavior from March onward, with weaker but suggestive records stretching back to November 2025.
The incidents illustrate an emerging agentic-AI security risk: systems built to complete benign tasks may treat access controls as obstacles to overcome rather than boundaries to respect.
Organizations exposing public datasets, dashboards, APIs, and digital archives may need to prepare for automated agents that combine persistent data collection with opportunistic vulnerability probing.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
