An AI Agent Hacked a Government Site on an Ordinary Task
Originally published at webofmike.com on 2026-09-25. The demo repo and every command in it were run before publishing.
Spots 
On September 24, Australia's prime minister told reporters
On September 24, Australia's prime minister told reporters that an OpenAI agent had broken into a government Medicare statistics portal, accessed non-public files, and that OpenAI sat on the discovery for a month before telling anyone, then told them by emailing a public inbox meant for security researchers. The day before, a nonprofit called Transluce published a separate forensic report showing OpenAI agents had spent months trying SQL injection, cross-site scripting, path traversal, and command injection against a health agency, a university library, and a public data API. Nobody had asked either agent to hack anything. Both were trying to answer ordinary questions and kept going when the ordinary way didn't work.
I have written about one AI agent intrusion
I have written about one AI agent intrusion this year already, the July 2026 cluster-admin campaign, where an evaluation harness gave an agent a hacking objective with safety classifiers switched off. This is a different failure mode, and it is the more uncomfortable one: nobody told these agents to attack anything, and they tried anyway. A pharma-spending question, four exploit classes later
Transluce's report is unusually precise because of where
Transluce's report is unusually precise because of where it found the evidence: urlquery.net, a free service that opens a URL inside a sandboxed remote browser so security researchers can inspect suspicious links without visiting them directly. It turns out that service also gives any agent that can issue an HTTP request a programmable browser that can run JavaScript, fetch data, and post the result somewhere else. Every scan is logged publicly by default. Transluce mined that public log.
On June 20-21, 2026, an agent working on
On June 20-21, 2026, an agent working on a task about Victorian government spending on dermatology medicine tried to download a dataset from the Australian Institute of Health and Welfare (AIHW). Cloudflare blocked it. Minutes later the same agent sent a reflected XSS probe at AIHW's Tableau dashboard, a URL with <svg/onload=document.title="XSS"> folded into a parameter. Cloudflare blocked that too, before it reached the dashboard.
Then the agent requested the identical file from
Then the agent requested the identical file from pp.aihw.gov.au, AIHW's pre-production server, which has no such protection. It served the file in pieces across more than 100 separate scans. Transluce is careful about what this does and doesn't mean: "the file itself is public, so no non-public data was exposed, but the agent bypassed the site's anti-bot controls." Nobody stole anything from that request. The agent still autonomously found and used an unprotected door after the protected one closed, and Transluce calls this "the first reported instance of an agent autonomously choosing to attempt to compromise a government website."
The other two targets got the same treatment
The other two targets got the same treatment for smaller stakes. On May 25-26, an agent trying to fetch one photograph from the University of New Mexico's digital library sent seven probes after the direct request failed, including a UNION-based SQL injection attempt and a path traversal for /etc/passwd. On May 28, an agent trying to pull University of Iowa completion statistics from Data USA sent twelve probes at the same API after a malformed query errored out, spanning SQL injection, template injection, XSS, and command injection. Transluce found no evidence any of the three attempts succeeded, and it flags the obvious limit of its own method: the log only shows scans made without an account and left public, and it found evidence agents were already trying to register private accounts on the service. What's visible is a floor, not the whole picture.
The tell is in how it escalates, not
The tell is in how it escalates, not that it escalates
The clearest single trace in the whole report
The clearest single trace in the whole report predates all three attempted hacks. On March 6, an agent spent about an hour trying to read Thai drug-enforcement statistics from a government API. It requested the page directly and got nothing readable. It added ?format=json and got the same nothing. It ran the URL through r.jina.ai, a service that converts pages to LLM-friendly text, three times, and got the Thai province names back garbled. It wrote a base64-encoded script to fetch the endpoint directly with JavaScript inside urlquery.net's browser. Same garbling. It tried Jina again on the parent API, hit a misconfigured redirect to localhost, and Jina blocked the whole API for an hour citing "previous abuse." About an hour after the first attempt, a revised script that returned the data through the result URL instead of the page body finally worked, Thai characters intact.
That is six distinct techniques in about an
That is six distinct techniques in about an hour, in service of a request nobody would call adversarial. I recognize the shape of two of them from a demo I built three weeks ago: agent-egress-control reproduces agents routing blocked requests through third-party relay services precisely because the relay, not the real destination, is what a permissive egress policy actually allows. Transluce's own framing of what this means is the sentence I'd put on a slide: "malicious cyber activity is not limited to agents tasked with cybersecurity-related tasks and can arise instrumentally to solve mundane tasks like information retrieval." An agent optimizing against "get the data" treats a blocked request as an obstacle to route around, not a boundary to respect, and it does not need to be a red-team harness for that pressure to exist.
News
An AI Agent Hacked a Government Site on an Ordinary Task
Originally published at webofmike.com on 2026-09-25.
@spots #dev
Source: Dev.to