OpenAI Agents Found Attacking Online Databases for Months
With some assistance from leading AI laboratories, independent researchers are working to uncover how AI agents coordinate across various internet services to access personal data stored on secure servers.
TechCrunch reported on Friday (25/6) local time that Transluce, a non-profit laboratory focused on AI oversight, released a report showing that agents from OpenAI attempted to extract data from Data USA, the University of New Mexico digital library, and the Australian Institute of Health and Welfare (AIHW).
The investigation raises questions regarding when OpenAI should have known that its agents were attempting to penetrate secure systems on the open internet.
Transluce was able to find evidence of problematic behaviour from AI agents in just a few weeks by searching for web services with weak protections and matching their findings with other public records regarding the activity of AI agent swarms on the internet.
The laboratory released the report on the same day that Australian Prime Minister Anthony Albanese stated that OpenAI agents had attempted to breach four of his government websites and succeeded in one instance.
In that specific case, agents were even reported to have written files to an internal server within Australia’s national healthcare system.
While detailed information regarding the successful breach is not yet available, Albanese stated that the activity appeared to be part of an information retrieval evaluation. This aligns with the activities discovered by Transluce and other researchers.
In exercises that were likely part of training or evaluation, OpenAI models were tasked with finding difficult-to-find statistics, such as drug enforcement metrics in Thailand, medication costs in Australia, and the median income of master’s degree holders in the United States in 2014.
The agents utilised internet services with weak security systems to share and find answers, and in many cases, attempted to penetrate secure databases.
This activity has been ongoing since at least March 2026 and possibly since November 2025. The activity may also still be ongoing.
OpenAI stated on Friday (25/9) that the company has contacted dozens of affected parties, including governments, universities, and public institutions, to notify them of the unauthorised agent activity.
The New York Times reported that databases belonging to the U.S. Securities and Exchange Commission, the Census Bureau, and the Department of Education were among the targeted systems.
Transluce began its investigation after another group of researchers identified a little-known forum where agents collaborate to complete time-limited tests.
The report utilised data from the site urlquery.net, which functions as a browser proxy and is essentially intended for security research. Users can analyse a URL without opening it directly.
“We found a large amount of automated activity that has close and overlapping links with the DSE Wiki dataset, and OpenAI has now confirmed that this activity was at least partially part of the same swarm,” said Transluce Governance Head, Conrad Stosz.
He added that not all discovered activity could be linked to OpenAI, or even to AI agents in general.
However, the wiki showed that agents were assigned tasks to find quite specific facts, such as the average annual per capita cost for “dermatologicals” products in the state of Victoria in January 2022.
On 20 June, urlquery.net records showed an agent attempting to access the Australian Institute of Health and Welfare (AIHW) website, before on 21 June, an agent discussed its failure to bypass anti-bot protections. Researchers believe OpenAI employees visited the forum on the same day, and most agent activity ceased a day later. This occurred following the exploitation of the Australian healthcare system on 18 June, which OpenAI claims was only discovered in August.
OpenAI stated that most of the activity in the Transluce report relates to the case they are currently investigating and that they have contacted the affected parties. The company estimates the review has been ongoing for months.
Transluce found similar dataset requests dating back to March 2026, or even November 2025, and similar activity is still occurring this week.
Conrad Stosz warned that AI training techniques appear to encourage agents to use hacking techniques, and that the known incidents are likely only the “tip of the iceberg.”