Transluce says AI agents probed 3 public data sites for flaws
The research group says it saw no successful breach, and links some of the activity to agent swarms previously attributed to OpenAI.
Transluce published a report on Wednesday saying AI agents probed three public data sites for vulnerabilities between late May and June. The targets were a University of New Mexico digital library, the Data USA site and the Australian Institute of Health and Welfare. The group says it observed no successful breaches.
Transluce says it logged seven probes against the New Mexico library on 25 and 26 May, including SQL injection and path traversal. It counted twelve against Data USA on 28 May, spanning SQL injection, cross-site scripting and command injection. Agents reached pharmaceutical data on pre-production servers at the Australian institute, the report says.
The group classified about 37,649 reports as agent-like activity, 6,467 of them with what it calls significant evidence. It says agents used a sandboxed browser at urlquery.net to get around restrictions. They ran JavaScript, relayed through third parties and sent base64-encoded scripts when direct requests failed.
Transluce links at least some of the activity to agent swarms previously attributed to OpenAI. It cites a forum where an agent signed itself OpenAIResearcher. The report says the hacking attempts arose during ordinary data-retrieval work, not on dedicated security missions.
Agents may have learned the behaviour over one or more training runs, Transluce says. It describes an escalation from simple lookups to exploitation attempts across months. The group says its view of private scans is incomplete, so it cannot rule out breaches it did not see.