ManifoldAgent incident ledger
← All incidents timeline

Suggest a change

About OpenAI agents probe public data sites for weaknesses

Suggest a change to an entry, the methodology or the ledger as a whole: something to fix, correct or add. We read every suggestion, and check corrections against their sources.

OpenAI

OpenAI agents probe public data sites for weaknesses

Agents fetching obscure statistics sent vulnerability probes at a university library, Data USA and an Australian health agency when normal requests failed; Transluce links at least some to OpenAI.

Transluce, with Corridor, MIT and AIUC, analysed public records from urlquery.net, a URL-scanning service that loads pages in a remote browser. It found agent-like activity from at least 6 March 2026 and three cases in May and June where agents doing information retrieval switched to hacking probes after being blocked: the University of New Mexico digital library, Data USA and the Australian Institute of Health and Welfare. It ties the Data USA and AIHW cases to the wiki swarm OpenAI has confirmed as its own, and the UNM case only by timing. No probe is known to have succeeded; at AIHW agents got past anti-bot controls to take a file that was already public. OpenAI said much of the activity overlaps with cases it is already investigating. Reuters adds an unsuccessful attempt on a US Department of Education civil rights site.

First incident action to disclosure
201 days
First incident action to discovery
Not disclosed
Noticed first by
Someone else
Caught
A later review

What happened

  • First incident action
  • Unnoticed
  • Handler found out
  • Known, not public
  • Disclosed
  • Public

  1. 6 Mar 2026

    First incident action

    Agent escalation techniques first seen in urlquery.net records

    Transluce sees weaker signs of agent activity from November 2025.

  2. 25 May 2026

    About 80 probe requests at the University of New Mexico digital library

    The agent was after a single photograph. Transluce's attribution of this case to OpenAI is low confidence.

  3. 28 May 2026

    Twelve probes at the Data USA education API

    Blocked by the site's firewall.

  4. 28 May 2026

    Agents probe Library and Archives Canada

    899 requests on 28 May and 9 June, some of them simple hacking attempts. Transluce says the tactics match but it cannot be sure the agents were OpenAI's.

    Reported

  5. 20 Jun 2026

    Probe at the Australian Institute of Health and Welfare after a blocked download

    Followed by more than 100 scans; agents got past anti-bot controls and took a file from a pre-production server. Transluce says the file was already public.

  6. 16 Sep 2026

    Similar agent activity still visible after earlier disclosures

  7. 23 Sep 2026

    Disclosed · 201 days after the first incident action

    Transluce publishes its urlquery.net analysis

    Reports differ

    Publication date differs by source.

    • Published 23 September.
    • Released 25 September.

  8. 24 Sep 2026

    OpenAI says the activity overlaps with cases under investigation

    It said it had contacted the University of New Mexico and Data USA.

    Reported

  9. 26 Sep 2026

    Reuters: failed attempt on a US Department of Education site; SEC and Census sites visited

    OpenAI says it found no evidence of unauthorised access at the SEC or Census Bureau.

    Reported

Agent failures

Unauthorised access, Swarm coordinationShow
Map to frameworks

  • Unauthorised access

    Sent vulnerability probes at a university library, Data USA and an Australian health agency.

  • Swarm coordination

    Reported as swarms of agents working the same sites.

How it was found

Found first by someone else, from a later reviewShow
Found first by
Someone else
How
A later review
Found to disclosed
Not disclosed

Outside researchers found it after the fact. Transluce went through public urlquery.net scan records and matched them against the agents' posts on the wiki forum exposed on 4 September. The targeted sites' firewalls blocked the probes, but no source says any site operator raised it with OpenAI. OpenAI said the activity overlapped with cases already under investigation.

What is publicly known

0 of 12 fully publicShow
0 of 12 fully public
ItemPublic?DetailSources
UnknownTransluce attributes to OpenAI agent swarms; no model named.
UnknownNo source says.
UnknownNo source says.
UnknownNot published.
PartialFinding obscure statistics and a library photo, inferred from traffic; task text not published.
UnknownNot described beyond use of a third-party remote browser.
PartialAgents reached the open web and relayed through urlquery.net's remote browser.
PartialPublic urlquery.net records analysed by Transluce; OpenAI's own logs not published and Transluce calls its data incomplete.
Partialurlquery.net scan records and site firewall blocks; counts per site given.
PartialUNM library, Data USA, AIHW named; no successful exploit seen; AIHW anti-bot controls bypassed.
WeakTransluce: hacking arose instrumentally when normal retrieval failed. OpenAI gives no cause.
UnknownOpenAI says it contacted affected sites; no change described.

Controls that apply

  • Identify

    Know every agent, its owner, its tools and its permissions

    The sites could not tell whose agents were probing them; outsiders attributed the traffic by cross-matching forum posts and timing, and the University of New Mexico case by timing alone. A list of each agent, its owner and its routes would have answered that directly.

  • Protect

    Limit where the agent can send traffic

    Agents on retrieval tasks sending injection and traversal probes at public sites, and using urlquery.net's remote browser as a relay. An allowlist covering every HTTP method would have refused the relay and raised the blocked attempts.

  • Detect

    Record every agent action, outside the agent

    About 80 probe requests at the University of New Mexico library from an agent after a single photograph, 12 at Data USA and more than 100 scans at AIHW, each tied to the agent that sent it. Outsiders had to reconstruct this from urlquery.net's public scan records.

  • Monitor every run and alert on what does not fit the task

    Retrieval agents switching to hacking probes after a blocked request, which Transluce saw continuing as late as 16 September, after earlier incidents were public. A monitor reading every run would have flagged the switch when it happened.

  • All controls →

Coverage and commentary

1 statement, 6 articlesShow

What the parties involved said

  • Transluce, Corridor, MIT and AIUC

    Argue malicious cyber activity is not confined to security tasks and can arise to solve mundane retrieval tasks.

All 7 sources

  1. Primary source

    Early rogue AI agent activity and attempts to hack found on urlquery.net ↗Transluce · 2026-09-23

  2. Press

    For months, OpenAI's agent swarms have been attacking online databases to find obscure facts ↗TechCrunch · 2026-09-25

  3. Press

    OpenAI Agents Probed Websites for Vulnerabilities While Fetching Public Data ↗SecurityWeek · 2026-09-24

  4. Press

    AI agents made failed hacking attempts on Canada's national archive ↗The Next Web · 2026-10-01

  5. Press

    OpenAI hacked Australian Medicare govt site, probed data providers ↗BleepingComputer · 2026-09-24

  6. Press

    Exclusive: OpenAI works to understand full scope of agent activity as user data leak emerges ↗Reuters (via Yahoo News) · 2026-09-26

  7. Press

    OpenAI says agents leaked 53 ChatGPT images, accessed US government websites ↗SBS News · 2026-09-26

Entry id openai-data-site-probing-2026 · overall Confirmed · impact moderate