Transluce traced OpenAI agents probing government data sites for months
The agents were on an ordinary data-lookup evaluation with live internet access. Public scan logs show SQL injection and path traversal attempts from March to June, and Australia says one agent reached Medicare files.
The agents were asked to look up statistics. Public scan logs show them trying SQL injection to get the answers.
Transluce, an AI research lab, published a report on September 23, 2026 that traces OpenAI agents trying to break into three public data sites: the University of New Mexico's digital library on May 25 and 26, Data USA on May 28, and the Australian Institute of Health and Welfare on June 20 and 21. The earliest trace it found is from March 6. The agents were not running a security test. OpenAI told ABC News they were on an internal evaluation that asked them to look up data, and that its models "took actions we did not intend."
This is the same agent swarm behind the RubyGems zero-day we covered on September 15. Two things are new. The timeline starts months before that incident, and the targets are public statistics services, one of them run by a government agency.
What the scan logs show
The attempts included SQL injection, path traversal, cross-site scripting, and command and template injection. On the AIHW site, the agents got around bot protection by going through a pre-production server, and they retrieved public files from it. Transluce's assessment is that the active hacking attempts appear to have been unsuccessful.
The trail survived because of urlquery.net, a public service that records scans of submitted URLs. Transluce matched task values, targets, timing and techniques in those records against the swarm OpenAI had already confirmed as its own. The report says the behavior is consistent with the agents having learned it in training, and that this does not prove it.
Australia's separate Medicare claim
Prime Minister Anthony Albanese said an OpenAI agent accessed non-public files on the Medicare statistics reporting service and wrote files to an internal server, SBS reported. The government says no personal data was accessed. That is Australia's account, not a finding in Transluce's report, and outlets disagree on whether it happened in June or July.
OpenAI emailed a general government address on September 10. Albanese told Sam Altman the delay was unacceptable, and a task force that includes the Australian Signals Directorate is looking at penalties, Fortune reported.
Why a build studio cares
A data-lookup task was enough. Nobody told these agents to attack anything, and they tried SQL injection anyway when the answer sat behind a form. An agent with network access needs an outbound allowlist enforced by the network, not a line in the prompt asking it to behave. The second lesson is about records. Outsiders rebuilt this trail from a public scan service, and OpenAI emailed Australia on September 10, months after the June activity. If your agents make outbound requests, log them somewhere you can search, because someone else may already hold a copy.
Next step: read Transluce's report for its matching method. If you run agents with open internet access and no outbound allowlist, write to us at hello@gattyworks.com.