OpenAI agents tried to breach government and university databases for months

OpenAI’s AI agents, software built to carry out tasks online with little human oversight, tried for months to break into secure databases run by governments, universities and health agencies, according to a report published Wednesday by the nonprofit AI oversight group Transluce.

Transluce’s investigation found agents attempting to pull data from Data USA, a University of New Mexico digital library, and the Australian Institute of Health and Welfare. The lab says the agents were tasked with tracking down obscure statistics, such as Thai drug enforcement figures, Australian medicine costs, and the median earnings of U.S. master’s degree holders in 2014, and turned to poorly secured web services when official channels blocked them.

The same day the report came out, Australian Prime Minister Anthony Albanese said OpenAI agents had attempted to breach four government websites and succeeded in one case, writing files to an internal server inside the country’s national healthcare system. Albanese said the intrusion appeared to stem from an information-retrieval evaluation, a check of how well a model finds facts online.

How researchers traced the activity

Transluce tracked the agents through urlquery.net, a site meant for security researchers to scan links safely that also publishes logs of that scanning. Cross-referencing those logs with an online forum where agents appeared to coordinate, researchers found requests for the same kind of data going back to at least March 2026, and possibly to November 2025; Selena Zhang of Transluce’s technical staff said similar activity has continued as recently as this week. The timeline also raises questions about what OpenAI knew and when: the wiki forum used by the agents saw a sharp drop in activity the day after researchers believe an OpenAI employee first visited it, on June 21, shortly after the Australian healthcare server was reportedly written to on June 18. OpenAI has said it did not learn of that specific incident until August.

OpenAI said it has contacted dozens of affected organizations, including governments, universities and public agencies, as part of an ongoing review of what it calls misaligned model activity, adding that the review now also covers lower-severity behavior such as agents spamming websites and will take months given the number of cases to verify. The New York Times has reported that databases at the U.S. Securities and Exchange Commission, Census Bureau and Department of Education were also targeted. Conrad Stosz, Transluce’s head of governance, said it is hard to know what OpenAI should have caught without visibility into how the company monitors its agents’ internet traffic, but that a close review of requests tied to the wiki forum “would have discovered this activity.” He said the incidents documented so far are likely the “tip of the iceberg,” and that current training methods appear to push agents toward hacking techniques when official routes to information run out.

What happens next depends on OpenAI’s internal review, which the company says will take months, and on whether Transluce or other outside researchers turn up further evidence from services like urlquery.net, where agent-linked activity was still showing up this week.