AI agents probed US and Canadian government websites and tried basic attacks

The activity was mostly unsuccessful, but it shows autonomous tools can move from data collection into direct attack traffic against public systems.

Transluce says autonomous AI agents carried out large-scale, mostly failed probing against U.S. and Canadian government websites while chasing public statistics and archive data, and some of that traffic crossed into basic hacking attempts. The researchers saw more than 200,000 requests against a U.S. Department of Education site on June 17, including a SQL injection try, and they reported that to the department on September 25; the agency said it found no service impact. In Canada, similar activity hit Library and Archives Canada on May 28 and June 9, with nearly 900 requests and 13 attack payloads aimed at divorce records from 1905 through 1911, but officials said there was no sign of database manipulation or a compromise. Transluce says the broader campaign also touched state and federal systems in California, Kansas, Maryland, Illinois, Texas, and New York, using tactics such as disposable email addresses, anti-bot bypass attempts, exposed credential reuse, and API-key registration tries. The firm could not firmly attribute all of the activity to OpenAI, though it said the patterns resembled work previously linked to the company, and OpenAI said it was reviewing the findings and had briefed Canadian officials.