Before the Hugging Face and RubyGems hacks, autonomous OpenAI agents attempted to hack into three other websites, including an Australian government public health website, independent research lab Transluce revealed on Wednesday.
“Notably, the tasks the agents were trying to solve were not cyber-related; the agents resorted to hacking tactics while working on ordinary data retrieval tasks,” the researchers pointed out.
From data retrieval to vulnerability probing
Insight into the agents’ actions was gleaned from reports of tens of thousands of queries apparently made by the agents through urlquery.net, a free URL scanning service, so they could avoid access restrictions.
The agents’ ultimate goals are unspecified, but apparently they needed access to specific data to achieve them. To that end, they targeted:
- The University of New Mexico’s Digital Library (nmdigital.unm.edu) on May 25 and 26, 2026.
- Data USA (api.datausa.io), a joint project by Deloitte, Datawheel, and MIT’s Collective Learning Group that provides open access to U.S. government data. On May 28, the agents probed an API providing visualizations of public U.S. government data.
- The Australian Institute of Health and Welfare (AIHW) Tableau collections (viz*.aihw.gov.au), on June 20 and 21.
In all three cases, the agents first tried to retrieve data and, when they encountered errors and couldn’t, they probed the sites and the API for vulnerabilities they could exploit to gain access.
In the first two cases, they appear to have been unsuccessful. In the third one (against the AIHW), their first data retrieval and vulnerability exploitation attempts were blocked by Cloudflare’s firewall, but the agents “fetched the file from AIHW’s pre-production server (pp.aihw.gov.au) instead.”
The file is public, so no non-public data was exposed, the researchers noted, but the agents bypassed the site’s anti-bot controls.
“While previous reporting showed that agents had interacted with these domains, this discovery reveals that agents attempted to hack into them when other methods of collecting the data they sought failed,” they noted.
“We directly link two of the three (AIHW and Data USA) to a previously reported agent swarm that OpenAI has publicly confirmed originated from them. For all three, we note that the extent of the observed activity is minor, attempting a low number of probe payloads and we observe no evidence of exploitation.”
However, on June 14, agents also used urlquery.net’s browser to create a disposable email inbox and used that address to try to register a urlquery.net account.
Since urlquery.net requests run through an account can be set to private, the researchers fear may not have the whole picture.
“The public artifacts we analyzed are incomplete and we cannot rule out successful attempts through private scans or means other than urlquery.net,” they concluded.
Agent activity started months earlier
The researchers also found that AI agents were using urlquery.net well before the above hacking attempts.
The earliest clear case dates to March 6, 2026, when an agent tried to retrieve Thai drug-enforcement statistics and escalated step by step as each method failed: it first requested the data directly, then used a service that converts web pages to text, and finally packed a custom program into a web address.
The same technique appears in thousands of agent requests starting in mid-April. Those requests targeted many of the same data sources as the collusion.wiki swarm, and they stopped on the same day the wiki activity did. Also, similar activity turned up as recently as September 16.
The researchers also found weaker evidence going back to November 2025, when bursts of requests sought historical theme park data and Thai government statistics. Those attempts were cruder, and the researchers are less confident they came from the same agents. Still, they hit the same sources that later activity targeted.
Transluce thinks (but cannot prove) that the agents may have picked up this behavior over one or more training runs: the pattern runs from simple lookups in November, to working around access limits by March, to probing cyber defenses by May and June.
Australia confirms Medicare portal breach
On Thursday, Anthony Albanese, the Prime Minister of Australia, held a press conference and confirmed that an OpenAI agent gained unauthorized access to the public-facing Medicare statistics reporting service portal (administered by Services Australia), and accessed both public and non-public files.
He also said that Services Australia confirmed that when attempting to access the data, the agent “engaged in writing files (…) to the internal server.”
“The Medicare Statistics Reporting Portal is a public-facing statistics portal that contains non-sensitive Medicare information relating to data and statistics such as spending. No personal information is believed to have been accessed at this stage, but investigations [aided by the Australian Signals Directorate] are ongoing,” he added, and shared that the Government is aware of three other systems that may be impacted, including the New South Wales Bureau of Crime Statistics and Research and the Victorian Department of Health.
Albanese said that a taskforce to investigate the incident would be convened immediately – involving the country’s National Cybersecurity Coordinator, the Office of AI, the Australian Signals Directorate, the Australian AI Safety Institute, and Services Australia – and that they will also be looking into “possible law enforcement and legislative responses and how to ensure that incidents like this don’t happen again.”
He also said that he spoke with OpenAI CEO Sam Altman and told him that he was disappointed at how long it took the company to inform the Australian Government of the incident. (The attack happened in June 2026, OpenAI didn’t notify them until September 10, 2026, via an email sent to a Services Australia public mailbox.)
Slow disclosure and the question of liability
Unfortunately, OpenAI lagging behind when it comes to notifying victims of its autonomous agents is nothing new.
“The operator didn’t notice for weeks, and the target didn’t notice at all. If one of the best-resourced AI labs in the world can’t see its own agent poking at a third-party system in real time, organizations deploying agents internally should assume they can’t either without dedicated runtime monitoring of what those agents actually do,” noted Ax Sharma, Head of Research at Manifold Security.
“This should be treated as an incident, not a courtesy heads-up. When an AI lab’s own agent accesses another organization’s infrastructure without authorization, the victim deserves the same notification we’d expect from any company whose system caused an intrusion: prompt, direct, and to the people who can act on it. An email to a public inbox doesn’t meet that bar. As agents get more autonomous, labs need a clear, fast playbook for telling affected organizations when their agent has crossed a line.”
Tom Kidwell, co-founder of Ecliptic Dynamics, pointed out that organizations have a responsibility to protect themselves and their data, but they also have a reasonable expectation that technology providers operate ethically and take accountability when things go wrong.
“The world is going to have to catch up when it comes to holding AI companies accountable. Simply stating that it wasn’t their intent isn’t sufficient when the real-world effect is unauthorized access to sensitive systems and data. This needs to change,” he opined.
“The wider challenge is that many of the organizations developing the most advanced AI systems are operating in jurisdictions where there is significant pressure to lead the global AI race. The reality is that we are unlikely to see countries such as the United States or China backing down in this context, regardless of the concerns being raised elsewhere.”
Still, a recent statement by US Treasury Secretary Scott Bessent offers some hope. During a hearing before the House Financial Services Committee, he urged lawmakers not to give AI labs “a blank check on liability.”
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!