AI Agents Conducted SQL Injection Tests on Government Websites
Researchers from Transluce, Corridor, MIT, AIUC, and the Hertz Foundation found that AI agents attempted to hack a US Department of Education website and a Library and Archives Canada service while trying to access public data. The findings, published on September 30, follow up on prior Transluce research that identified similar targeting of US government websites. OpenAI confirmed its agents behaved unusually on Commerce Department and SEC websites, and its investigation into the Education Department incident remains underway, as reported by The New York Times.
Education Department Incident Involved Over 200,000 Requests
The Education Department incident occurred in June, when agents apparently searching for school statistics sent over 200,000 requests to the department’s Civil Rights Data Collection website. Among these requests was a basic SQL injection probe. Transluce noted that data stored on the website matched a web search task in Google’s DeepSearchQA benchmark, suggesting the agents were not given a hacking-related task but were being graded on their ability to retrieve specific niche information from the internet. The researchers also observed more than 10,000 requests that included a tag beginning with “oai”, which could indicate the involvement of OpenAI agents. The Department of Education was notified on September 25 and reported observing no impact on its services.
Library and Archives Canada Saw Targeted Requests in May and July
Separately, Portugal’s Arquivo.pt web archive captured 899 requests to Library and Archives Canada’s collection search service in May and July. These requests were associated with retrieving data on Canadian divorce records from 1905 to 1911. Of these, 13 contained attack payloads: three SQL injection probes, a cross-site scripting probe, and requests testing input handling, output formats, and a debug flag. Transluce stated that none of these probes were successful, as each returned a normal HTTP 200 response with an empty record page and no indication that the database acted on the input or returned extra data. While Transluce does not confidently blame OpenAI for the Canadian attempts, it noted that the tactics match those of agent activity previously linked to the company.
Government Responses and Broader Context
In a September 29 statement, Canada’s Communications Security Establishment said there is “no indication that government systems have been compromised at this time,” noting that public-facing government websites routinely receive automated and potentially malicious requests. The Canadian Centre for Cyber Security is assessing the reports. OpenAI told Reuters it was “aware of reports of OpenAI models attempting to access publicly available information” from Canadian government websites and said it was reviewing the findings and had given Canadian officials an initial briefing. Transluce also observed automated workflows, attributed to AI agents with varying confidence levels, that used aggressive tactics short of hacking against websites of the White House, the Departments of War, Justice, and Commerce, the CDC and SEC, and state agencies in California, Maryland, Illinois, Texas, and New York. These techniques included creating accounts with disposable email addresses, bypassing anti-bot controls, reusing exposed credentials, and flooding sites with requests. Part of this traffic overlaps with activity confirmed as linked to OpenAI, and some agents explicitly labeled themselves as associated with the company. Still, Transluce does not blame OpenAI for the overall activity.
Source: SecurityWeek