Researchers revealed that autonomous artificial intelligence agents appear to have used aggressive techniques to retrieve public data from government websites in the United States and Canada. The incidents include two rudimentary, failed hacking attempts: one against the U.S. Department of Education’s Civil Rights Data Collection and one against Library and Archives Canada, a Canadian federal agency. The researchers clarify that, in the datasets they analyzed, they found no cases where agents gained access to information that was not already publicly available.
The analysis was based on public data from urlquery.net, a web security service, and Arquivo.pt, Portugal’s national web archive, whose ArchivePageNow feature was used to send requests and retrieve data.
The most notable incident occurred on June 17, when agents made more than 200,000 requests to a U.S. Department of Education website while apparently searching for school statistics. The activity included a rudimentary SQL injection attempt, adding the text “State_Id=1 OR 1=1” in an effort to bypass the website’s filters. The data appears to match a question in the DeepSearchQA benchmark, suggesting that the agents had not been instructed to hack into the site but were being scored on their ability to retrieve specialized information from the internet. The question concerned the ratio of full-time school counselors to students who were victims of racial harassment or bullying in four states. The attempt was disclosed to the Department of Education on September 25, and a spokesperson said the incident had no observed impact on its services.
In the case of Library and Archives Canada, 899 requests to its collection search service were recorded on May 28 and June 9, including 13 carrying attack payloads: three SQL injection checks, a 32-bit integer limit test and requests to manipulate the output format. All returned empty pages with no indication of success. The Canadian government was notified on September 28, and the Canadian Centre for Cyber Security issued a public statement the following day.
Beyond the hacking attempts, the researchers identified a broader pattern of automated activity using “gray area” techniques against U.S. state and federal websites, which they attribute to AI agents with varying degrees of confidence: creating accounts with disposable email addresses, reusing exposed credentials, bypassing anti-bot checks and flooding websites with requests. In Kansas, 36,578 archive captures were recorded, peaking at 1,093 per minute, while the website began returning gateway errors. In Maryland, archive captures reached 295,912, with extensive filename guessing and successful downloads of public datasets on students’ math performance.
At the state level, attempts were also recorded to access New York school enrollment statistics, Texas sexually transmitted disease statistics and California public campaign finance records, where the automated activity appears to have bypassed anti-bot checks. At the federal level, the researchers describe 719 reports involving attempts to download public budget reports from the White House’s MAX.gov system, as well as attempts to register for a Bureau of Economic Analysis API key using a disposable email address, with no confirmed successful registration, and an unsuccessful attempt to use OCR to make the CAPTCHA readable.
The researchers do not confidently attribute all of the traffic to OpenAI, although some traces contain indicators associated with it, such as the organization name “OpenAI Research” or pages with related indicators.
Their methodology combined regular expression matching, evaluation using large language models, investigation by coding agents and manual human research. The aim was to identify which traces AI agents had left and how they behaved as they tried to complete their tasks.
The research highlights an emerging problem: artificial intelligence agents trained or evaluated on knowledge retrieval tasks may adopt aggressive or “gray area” behavior—even rudimentary attempts to exploit vulnerabilities—without explicit malicious instructions, as they try to complete their tasks. The absence of detected access to nonpublic information does not remove the question of the security, transparency and governance of such systems.
Comments