AI agents attempting to retrieve public information appear to have crossed an important security boundary: instead of simply searching government websites, some began behaving like penetration-testing tools.
Researchers affiliated with Transluce, Corridor, MIT, AIUC and the Hertz Foundation identified automated activity targeting websites operated by the US Department of Education and Library and Archives Canada. Among hundreds of thousands of requests were SQL injection probes, cross-site scripting attempts and other techniques normally associated with testing applications for vulnerabilities.
There is no evidence that the attempts successfully compromised government systems or accessed non-public information. What makes the incidents significant is that the agents may not have been instructed to hack anything at all.
From Web Search to Vulnerability Testing
The most striking case involved the US Department of Education’s Civil Rights Data Collection website. In June, agents apparently searching for school statistics generated more than 200,000 requests against the service, including a basic SQL injection probe.
Researchers believe the activity may have originated from an AI benchmark designed to evaluate how successfully models retrieve obscure information from the internet. Data available through the government website appears to match a search task contained in Google’s DeepSearchQA benchmark.
More than 10,000 requests contained a tag beginning with “oai,” potentially connecting part of the traffic to OpenAI infrastructure. OpenAI has previously confirmed unusual agent behavior involving Commerce Department and Securities and Exchange Commission websites, while its investigation into the Education Department incident remains ongoing.
The Department of Education said it observed no impact on its services.
Similar Behavior Appeared in Canada
Researchers found another cluster of suspicious requests targeting Library and Archives Canada’s collection search service. Portugal’s Arquivo.pt web archive captured 899 requests during May and July associated with searches for Canadian divorce records dating from 1905 to 1911.
Thirteen contained attack-like payloads, including three SQL injection probes, a cross-site scripting attempt and requests testing input handling, output formats and debugging functionality.
The researchers found no indication that these probes worked. Responses returned normal pages without evidence that database commands had executed or additional information had been exposed.
Canada’s Communications Security Establishment similarly said there was no indication government systems had been compromised. OpenAI acknowledged reports involving its models attempting to retrieve publicly available information from Canadian government websites and said it was reviewing the findings.
When Persistence Becomes Offensive Behavior
The incidents reveal an uncomfortable problem with autonomous browsing agents. A human searching for information will normally stop when a website refuses to provide it. An agent optimized to complete a task may instead keep experimenting.
Transluce researchers observed other automated workflows using aggressive techniques against US federal and state government websites. These included creating accounts with disposable email addresses, attempting to bypass anti-bot protections, reusing exposed credentials and generating large volumes of requests.
Some of the traffic overlaps with activity confirmed as OpenAI-related, and certain agents explicitly identified themselves as associated with the company. However, researchers have not attributed all of the observed activity to OpenAI.
The distinction is important. These agents were not necessarily operating with malicious intent, but their attempts to overcome obstacles began resembling techniques security teams normally classify as hostile.
AI Safety Meets Application Security
The incidents illustrate why agentic AI creates a different security problem from conventional chatbots. A chatbot can suggest a SQL injection payload; an autonomous agent with internet access can potentially decide to send one.
That shifts safety from controlling what a model says to controlling what software built around the model is allowed to do.
Agent developers increasingly need mechanisms capable of distinguishing legitimate information retrieval from vulnerability probing, credential reuse, anti-bot bypasses and other actions that should require explicit authorization. Rate limits, network policies, tool permissions and real-time monitoring become part of the AI safety architecture rather than ordinary infrastructure controls.
For website operators, the problem is equally important. Internet-facing systems will increasingly receive traffic generated not only by traditional bots and attackers but by autonomous agents pursuing legitimate goals through unpredictable strategies.
The government incidents did not result in a known breach. But they expose a more consequential question for the agentic era:what happens when an AI tasked with finding an answer independently discovers that hacking is one possible way to get it?