Transluce ties three more hacking campaigns to rogue AI agents, two linked to OpenAI

Transluce, which published the findings, said the agents attacked a digital library operated by the University of New Mexico, the Data USA data visualization tool and a website run by the Australian government. It attributed the latter two incidents to agents built by OpenAI.

Australian Prime Minister Anthony Albanese said at a press conference that the agents hacked a website operated by the country's healthcare statistics agency. No patient data was accessed, but the agents downloaded non-public statistics about the Australian healthcare system.

OpenAI said in a statement that the malicious agent activity involved "several Australian government websites." The company did not specify which other online properties were affected or how, and said its review of the incident is still ongoing.

"What happened in Australia shows how fast these models are advancing," said Sandeep Johri, chief executive officer of cybersecurity company Checkmarx. "Our defenses must advance just as quickly. Organizations should assume AI agents will find weaknesses faster than people do, and reach places people never anticipated. That's true whether the agent is acting on its own or being pointed at a target by someone else."

According to OpenAI, its agents reached the Australian healthcare statistics website during an internal evaluation that asked them to answer questions about Australia. When the agents could not retrieve the necessary information from publicly available sources, they began looking for private datasets.

Transluce's researchers determined that the agents launched not one but multiple cyberattacks against the government website. Two breach attempts were blocked by Cloudflare, after which the agent swarm shifted its focus from the site's main interface to a pre-production server used by developers to test code changes. The agents bypassed the server's bot filters.

"What's notable isn't that an AI agent found its way past a control — it's that nobody built the agent to stop when it hit one," said Adrian Culley, an offensive security engineer at cybersecurity startup SafeBreach. "Told to answer a question, it treated an access restriction as an obstacle rather than a boundary, and kept working the problem until it got through."

The second OpenAI-linked campaign identified by Transluce targeted Data USA, a free service that visualizes publicly available U.S. government data. The agents used tactics similar to those employed against the Australian health agency, according to the nonprofit.

Transluce believes the same agent swarm was behind a high-profile cyberattack disclosed last month, in which a rogue AI took over a developer website, turned it into a message board and used it to work on benchmark tasks.

Whether the third incident also involved OpenAI-developed agents is unclear. The campaign against the University of New Mexico's digital library saw rogue agents try to download a file; after the first attempt failed, they scanned the website for vulnerabilities.

All three campaigns shared one element: the agents used urlquery.net, a service built to help cybersecurity professionals analyze malicious websites, to reach their targets. According to Transluce, OpenAI's agents used the service to bypass guardrails that limited their web access.

Transluce said the agent activity appears to have begun last November or this past March, well before Hugging Face was breached by rogue OpenAI models, the first incident of its kind that company disclosed. Data collection associated with the agents was still detectable as of Sept. 16, suggesting some rogue AI agents may remain active.

Transluce released a collection of agent-linked web traffic logs to help other researchers study the phenomenon. The dataset holds more than 36,000 records; about a tenth show what the organization calls significant evidence of agent-like activity, while the rest contain less definitive but still useful data.