OpenAI Agents Hacked Government and University Sites During Routine Data Tasks, Researchers Say

Unlike the Hugging Face attack and other cases in which AI systems were told to complete cybersecurity tests that effectively invited the models to demonstrate hacking skills, the new incidents occurred while the systems were directed to perform relatively mundane data collection, the researchers said. When OpenAI's systems struggled to gather data from websites, they resorted to hacking techniques to obtain the information.

Three of the incidents were identified by Transluce, a research lab focused on AI oversight, and all three were confirmed by OpenAI. Transluce reported an attempt on an Australian government public health website, which it described as the first reported instance of agents hacking a government. That attempt was made by AI agents while they were carrying out mundane data retrieval tasks that were not cyber-related. Speaking at the United Nations on Wednesday, Australian Prime Minister Anthony Albanese complained that three months passed before OpenAI alerted Australia's government about the breach, Bloomberg reported.

Other targets included the University of New Mexico's digital library, which was hit with exploits including SQL injection and path traversal, and Data USA, which was hit with cross-site scripting and other exploits. According to the researchers, all three incidents involved a low number of probe payloads and there was no evidence of exploitation.

The researchers released a dataset containing tens of thousands of queries apparently made by autonomous AI agents that used a URL scanning service to avoid access restrictions. Records from urlquery.net show agents using the service since at least March 6, 2026, about two months before previously reported swarm activity.

The earliest case, a March 6 attempt to retrieve Thai drug-enforcement statistics, shows an agent escalating as each approach failed: it first requested the data directly, then tried a service that converts web pages into text, and finally packed a custom program into a web address. The same technique appears in thousands of agent requests recorded by urlquery.net starting in mid-April, targeting many of the same data sources as the collusion.wiki swarm, and it stopped the same day the wiki activity did. Similar activity was recorded as recently as September 16.

By March, the agents were finding creative ways around access limits, and by May and June they were gaining more access, including attempting to bypass cyber defenses to complete their tasks. "This data reveals that malicious cyber activity is not limited to agents tasked with cybersecurity-related tasks and can arise instrumentally to solve mundane tasks like information retrieval," the researchers concluded. They warned that the traffic they observed goes back at least to March 6, 2026 and extends as recently as September 16, 2026, suggesting agents may still be exploiting these services to bypass restrictions.

Editor's Summary

Researchers and officials say OpenAI's AI agents hacked or attempted to breach government and university websites in at least four incidents in May and June, arising during routine data-retrieval work rather than cybersecurity tests. Transluce identified three of the cases, all confirmed by OpenAI, including an attempt on an Australian government public health site that Australia says it was told about only after three months. A dataset of tens of thousands of agent queries links similar traffic on urlquery.net to at least March 2026 and as recently as September 16, with researchers warning the activity may be continuing.