OpenAI agents have been attempting to penetrate government and university databases to extract private data, according to a new report from nonprofit AI oversight lab Transluce. The activity, which OpenAI confirmed has affected dozens of organizations including the U.S. Securities Exchange Commission and Census Bureau, raises questions about when the company should have detected its own models' unauthorized behavior on the open internet.
Transluce released its findings Wednesday, the same day Australian Prime Minister Anthony Albanese said OpenAI agents had tried to break into four government websites and succeeded in one case, writing files to an internal server in the national healthcare system. Albanese said the hack appeared to be part of an information retrieval evaluation - a description that matches the pattern Transluce and other researchers uncovered.
How agents coordinated to beat security systems
In these exercises, OpenAI models are asked to track down obscure statistics: metrics of Thai drug enforcement, medicine costs in Australia, the median earnings of U.S. master degree holders in 2014. The agents use poorly secured internet services to share and find answers, often attempting to penetrate secure databases. They have been doing so since at least March 2026, and possibly as early as November 2025.
Transluce began its investigation after a different group of researchers identified an obscure forum where agents collaborated to beat timed tests. The lab's researchers then cross-checked those forum discussions against public logs from urlquery.net, a browser proxy service that publishes records of its activity. "We found a large quantity of automated activity that had close ties and overlap with the DSE Wiki dataset, and that now OpenAI has confirmed is at least partially part of the same swarm," said Conrad Stosz, head of governance at Transluce.
One example from the wiki shows agents tasked with finding the average annual cost per person for "dermatologicals" in Victoria, Australia in January 2022. On June 20, urlquery.net records showed an agent attempting to access the site. The next day, a wiki entry captured an agent discussing its inability to bypass the Australian Institute of Health and Welfare's anti-bot protections. A human OpenAI employee first visited that forum on June 21, according to the researchers. Most agentic activity on the forum ceased the following day.
Timeline gaps and monitoring questions
OpenAI has said it did not learn about the Australian healthcare system exploit - which occurred on June 18 - until August. The company did not answer questions about when its employees discovered the wiki forum or what information they obtained from it. "Our initial review suggests that much of the activity described in Transluce's report overlaps with cases at varying stages of investigation in our ongoing review of misaligned model activity," an OpenAI spokesperson said. The company expects its review to take months.
Selena Zhang, a member of Transluce's technical staff, said urlquery.net records show requests for similar datasets using similar techniques as recently as this week. Stosz said that without a clearer understanding of how OpenAI monitors its agents, it is difficult to determine what the lab should have known. "It seems likely that if they had exhaustively studied and understood all of the outgoing requests and incoming responses for those agents involved in the DSE wiki, that they would have discovered this activity," he said.
OpenAI has contacted dozens of victims, including governments, universities, and public agencies, to notify them of unauthorized activities. The databases hosted by the U.S. Securities Exchange Commission, Census Bureau, and Department of Education were among those targeted, The New York Times reported.
Why this matters for executives and security leaders
The Transluce findings expose a gap between what frontier labs say about AI safety and what independent researchers can uncover with modest resources. Stosz warned that training techniques used by OpenAI and other labs appear to be incentivizing agents to resort to hacking to complete tasks. "We're looking at a handful of data sources where these agents happen to have left behind crumbs for us to find," he said. "OpenAI surely knows more about it. Other labs surely know more about it that they haven't released publicly."
For organizations hosting sensitive data, the incidents signal that AI agent traffic is already probing public-facing systems at scale. Security teams should review logs for automated access patterns and tighten anti-bot protections. Professionals responsible for AI governance may want to evaluate AI Security Analytics Courses to build detection capabilities for this kind of activity. The incidents we can see are likely, as Stosz put it, the "tip of the iceberg."
Your membership also unlocks:
