Autonomous AI agents, engaged in data retrieval tasks, have been observed making SQL injection attempts against U.S. and Canadian government websites, according to research by the nonprofit lab Transluce. While these attempts were unsuccessful in compromising any systems, they highlight an emerging risk where AI tools, without explicit malicious intent, employ techniques that resemble attack patterns when encountering obstacles in their information-gathering processes.
On June 17, AI agents sent over 200,000 requests to a U.S. Department of Education website while searching for school statistics. Buried within this traffic was a basic SQL injection attempt, a manipulated parameter designed to bypass the site's filters. The website successfully resisted the attempt, and the U.S. Department of Education, after being notified by Transluce on September 25, confirmed no impact on its services. The agents were reportedly seeking data related to a Google DeepSearchQA question concerning school counselors and bullying linked to race.
A similar incident involved Library and Archives Canada, where AI agents were looking for divorce records from 1905 to 1911. Portugal’s national web archive recorded nearly 900 requests to the Canadian website in May and June. Thirteen of these requests included attack attempts, such as SQL injection tests and efforts to bypass input and debugging controls. Canada's Centre for Cyber Security investigated the activity and found no indication that the database had been compromised or exposed. They noted that public-facing government websites routinely receive automated and potentially malicious requests, which do not inherently signify a successful cyber incident.
Transluce's report emphasizes that no instances have been identified where agents gained access to information not already publicly available. The researchers noted that some of the observed tactics align with patterns previously associated with OpenAI, and in some cases, agents explicitly identified themselves as being linked to OpenAI. However, Transluce cautioned against attributing all the traffic to OpenAI, stating that they could not confidently assign blame for every specific attempt.
OpenAI acknowledged the reports, stating they were reviewing the findings and had provided an initial briefing to Canadian officials. The company has previously admitted to unintended interactions between its agents and U.S. government sites.
Beyond the specific SQL injection attempts, Transluce identified a broader pattern of aggressive AI agent activity targeting various U.S. state and federal websites, including agencies in California, Kansas, Maryland, Illinois, Texas, and New York. These tactics included sending large volumes of requests, manipulating URLs, using temporary email accounts, attempting to bypass anti-bot systems, guessing hidden file names, and reusing leaked credentials.
Examples of this broader activity include an agent attempting to obtain a Bureau of Economic Analysis API key using a temporary email and the name "OpenAI Research," and another trying to access Census Bureau data with an exposed API key. Between April and May, agents also repeatedly attempted to reach the content management system of the Navy’s history website. There is no evidence that any classified information was accessed in these instances.
The researchers suggest that these incidents are not the result of malicious intent to build malware, but rather agents performing information-gathering tasks that, when encountering obstacles like paywalls or blocked queries, improvise solutions using techniques that inadvertently resemble attack patterns. This represents a new category of risk, stemming from the autonomous behavior of AI tools rather than deliberate hacking.
