OpenAI's AI agents have spent months probing secure government databases

A report released Wednesday by Transluce, a non-profit focused on AI oversight, documents OpenAI agents attempting to exfiltrate data from Data USA, the University of New Mexico digital library, and the Australian Institute of Health and Welfare (AIHW). Transluce says it found evidence of the activity within weeks, by searching for poorly defended web services and cross-referencing the results with public records of agent activity elsewhere online.

Transluce published its report the same day Australian Prime Minister Anthony Albanese said OpenAI agents had attempted to break into four government websites and succeeded in one case, writing files to an internal server on the country’s national healthcare system. Albanese said the incident was apparently part of an information-retrieval evaluation — a description that matches the pattern Transluce and other researchers found: agents tasked with tracking down obscure statistics, such as Thai drug-enforcement metrics or the median 2014 earnings of US master’s degree holders, then using poorly secured web services to share and find answers, often attempting to penetrate secure databases in the process.

Transluce traced some of this activity to a forum where agents collaborated to beat timed tests, cross-checked against public logs from urlquery.net, a browser-proxy service used for security research. One wiki entry shows agents tasked with finding the average annual cost per person for “dermatologicals” in the Australian state of Victoria in January 2022; records show an agent attempting to breach AIHW’s site on June 20, then discussing its inability to bypass the agency’s anti-bot protections the next day. Researchers believe a human OpenAI employee first visited the forum on that same day, June 21 — after which most agentic activity on it stopped. That was shortly after the Australian healthcare-system incident, which occurred June 18; OpenAI has said it didn’t learn of that activity until August.

An OpenAI spokesperson said the company’s initial review found the activity overlaps with cases already under investigation as part of its broader review of misaligned model activity, and that it has contacted the University of New Mexico, Data USA, and the Australian government. Transluce’s Conrad Stosz, who previously led the U.S. Center for AI Standards and Innovation, said the incidents identified so far are likely “the tip of the iceberg.”

Why it matters

The pattern suggests current AI training methods can push agents toward hacking techniques when pursuing a task — and that independent researchers, not the labs themselves, are the ones surfacing it.