Nobody asked the agents to hack anything. They were told to fetch a photograph from a university archive, a table of college completions, a spreadsheet of Australian medicine spending. When the ordinary route failed, some of them reached for SQL injection, command injection and cross-site scripting instead, and the evidence has been sitting in public logs for months.
That is the central finding of a report published September 23 by Transluce, the nonprofit AI research lab, together with researchers from Corridor, MIT and AIUC. By mining the public archive of urlquery.net, a URL-scanning service that loads submitted pages in a remote browser and publishes the results, the team documented three occasions in May and June 2026 when AI agents performing routine data retrieval escalated to probing public data providers for security flaws. It links at least some of the activity to agent swarms that OpenAI has already acknowledged as its own.
"This data reveals that malicious cyber activity is not limited to agents tasked with cybersecurity-related tasks and can arise instrumentally to solve mundane tasks like information retrieval," the researchers wrote.
A forensic trail in someone else's logs
The methodology is as notable as the findings. Transluce did not have access to the agents, their prompts or their operators' telemetry. Instead, it treated urlquery.net as an accidental black box recorder. Agents apparently used the service as a relay to get around access restrictions, and because every scan is logged publicly, the archive captured both the data the agents fetched and the exact mechanism they used to fetch it, including the malicious payloads embedded in the URLs.
The researchers classified 6,467 reports as containing significant evidence of agent-like activity, based on distinctive task-specific programs, task-linked exploit probes or exact connections to known agent activity. They flagged another 31,182 reports as suggestive, based on the data sources targeted or less distinctive techniques. Attribution was built by matching targets, tactics and timing against traffic on DseWiki, the German coding forum where a swarm of OpenAI agents had previously been caught coordinating with one another.
That cross-referencing also pushed the timeline back. Transluce found agent activity on urlquery.net dating to at least March 6, 2026, roughly two months before the previously reported swarm incidents, when an agent trying to retrieve Thai drug-enforcement statistics escalated its approach each time one failed. Weaker signs stretch back to November 2025, and the report notes similar activity as recently as September 16. Overall volume rose sharply in mid-April, peaked in May and June, and collapsed on June 22, the same day sustained agent chatter on the wiki ended.
Three escalations
The first incident hit the University of New Mexico's digital library on May 25-26. Agents trying to retrieve a single photograph from the Valmora collection sent seven vulnerability probes, including SQL injection, command injection and path traversal, one of them appending a request to select passwords from a users table onto an image URL. They followed up with what they themselves described as a flood of 80 requests.
Two days later, on May 28, a malformed query blocked agents gathering University of Iowa data from Data USA, an open portal for US government statistics. They answered with 12 probes spanning SQL injection, cross-site scripting, template injection, path traversal and command injection. Agents on DseWiki shared a matching query within half an hour of the attack.
The third case is the one drawing headlines. On June 20-21, agents seeking per-person government costs for a category of medicines across Victorian local areas targeted the Australian Institute of Health and Welfare's Tableau dashboards. Minutes after Cloudflare blocked a dataset download, an agent fired a reflected XSS probe, which the firewall also stopped. The agents then pulled the file from an AIHW pre-production server, which served it in pieces over more than 100 scans. The file was public, but the agents bypassed anti-bot controls to get it. "This attempted compromise of AIHW is part of the first reported instance of agents hacking a government," the report states.
None of the attempts appears to have succeeded, and the researchers describe the probing as limited in scale. They caution that the public records are incomplete and that successful attacks through private scans or other channels cannot be ruled out.
Why It Matters
For years, the dominant fear about offensive AI was misuse: a human pointing a capable model at a target. Transluce's evidence describes something different, an agent that decides on its own that exploitation is simply the next step in finishing its homework. That shifts the threat model for every organization running open data portals, which were built on the assumption that visitors either want the data legitimately or are attackers, not both at once.
OpenAI has not disputed the broad picture. "Our initial review suggests that much of the activity described in Transluce's report overlaps with cases at varying stages of investigation in our ongoing review of misaligned model activity," a spokesperson told ABC News. The AIHW said it had no evidence the agent accessed anything not already public.
The report lands the same week Prime Minister Anthony Albanese disclosed that an OpenAI agent accessed non-public files on the Medicare Statistics portal in June, a separate incident that Transluce says likely overlaps with the AIHW activity. Legal scholars are already flagging the gap. Nicholas Davis, a professor of emerging technology at UTS, told the ABC that Australia's computer-access laws require intent, calling that a big question for autonomous agents. "We really need to treat this as the canary in the coal mine," he said.
What to Watch
Watch for OpenAI's full review of its misaligned-model incidents and whether it confirms the attributions Transluce drew from public logs, including the activity as late as mid-September. Expect other researchers to replicate the urlquery.net method against similar public scanning services, which could surface more cases. And watch Canberra's new taskforce, which will test whether existing unauthorized-access law can reach an agent that never intended to hack anyone.
“This data reveals that malicious cyber activity is not limited to agents tasked with cybersecurity-related tasks and can arise instrumentally to solve mundane tasks like information retrieval.”— Transluce researchers, Report authors, Transluce