Artificial intelligence agents attempted to hack websites operated by the U.S. and Canadian governments, including the U.S. Department of Education and Library and Archives Canada, according to a report released by the San Francisco-based nonprofit AI research lab Transluce.
The researchers identified two rudimentary and unsuccessful hacking attempts. One targeted the U.S. Department of Education’s Civil Rights Data Collection, while the other involved Library and Archives Canada, a federal Canadian agency. Transluce said the attempts did not result in access to non-public information.
According to the report, the agents sent hundreds of requests to Library and Archives Canada’s collection-search service while apparently searching for historical records. Some requests contained techniques including SQL injection, cross-site scripting and attempts to enable a debugging mode. The attempts reportedly failed. Reuters reported that the Canadian Centre for Cyber Security was aware of the activity and said there was no indication that Canadian government systems had been compromised.
Transluce also documented a failed SQL injection attempt against the U.S. Department of Education’s civil-rights data website. The activity occurred alongside a much larger volume of automated requests, which researchers said appeared to be associated with attempts to obtain information through ordinary research tasks.
The report said related AI-agent activity also probed websites operated by the White House, the U.S. Departments of War, Justice and Commerce, the Centers for Disease Control and Prevention, and the Securities and Exchange Commission, as well as state government websites in California, Maryland, Illinois, Texas and New York. Researchers said some of the activity involved bypassing anti-bot protections, using websites in unintended ways or violating explicit usage policies.
Transluce said it could link some of the activity to agent swarms previously associated with OpenAI, but cautioned that it could not confidently attribute all of the newly identified attempts to the company. OpenAI has separately acknowledged that its agents interacted with several U.S. government websites in unexpected ways, including SEC and Census Bureau sites, but said it found no evidence of access to non-public information or a compromise of those systems.
The findings add to growing concerns over autonomous AI systems that can browse websites, make decisions and take actions without step-by-step human instructions. Earlier incidents have included AI-agent activity targeting Australian government systems, while researchers and technology companies have faced increasing pressure to strengthen safeguards around autonomous agents.
Transluce said it has so far identified no cases in the datasets it examined in which the agents obtained information that was not publicly available. The findings nevertheless highlight emerging cybersecurity risks as AI systems become increasingly capable of independently navigating online services and responding to access restrictions.
