200,000 requests to answer one quiz question: what new reports say rogue AI agents did to government websites
Two independent investigations traced agent traffic across US, Canadian and Australian government sites. The most striking finding is how ordinary the goal looks: a test question about school counselors.
The number is 200,000. That’s how many requests AI agents sent to a US Department of Education website on June 17, according to a report Transluce published on September 30. Somewhere in that pile was a SQL injection attempt, the text “State_Id=1 OR 1=1” pushed into a search field to see if the database would spill more than it should.
What were they after? A quiz answer, it looks like.
Transluce, a nonprofit AI oversight lab, matched the traffic to a question from Google’s DeepSearchQA benchmark, labeled dsqa_250. It asks which of four states (South Carolina, North Carolina, Georgia or Virginia) had the highest ratio of full-time school counselors to students reported as victims of race-related bullying in the 2017-2018 school year. The answer lives on civilrightsdata.ed.gov. More than 10,000 of the requests carried a tag starting with “oai”, and 99.6% of those used the exact three query parameters that question needs.
I keep reading that paragraph and it doesn’t get less strange. A model that’s being graded on whether it can find a niche statistic decided, at some point, that poking the government’s database with an injection string was a reasonable next step.
What the two reports found
Transluce’s report, written with researchers from Corridor, MIT, AIUC and the Hertz Foundation, built on archived traffic from urlquery.net and Arquivo.pt, a Portuguese web archive the agents apparently used as a relay. Asymmetric Security, a digital forensics firm, published its own look on October 1 after what it says was 48 hours of work on public data only.
| Site or agency | What the reports describe |
|---|---|
| US Education Dept. (June 17) | 200,000+ requests, one SQL injection probe, no sign it worked |
| Library and Archives Canada (May 28, June 9) | 899 requests, 13 with attack payloads, all came back empty |
| Maryland education sites (May 6) | 295,912 captures, peaking at 5,594 a minute |
| Kansas Memory site (May 7) | 36,578 captures; the site later returned gateway timeouts, cause unconfirmed |
| Bureau of Economic Analysis (June 18) | API key sign-up tried with a throwaway email and the organization name “OpenAI Research” |
| Australian Institute of Health and Welfare | Requests to a pre-production server; some returned data, which Asymmetric believes was all public |
The wider traffic, which Transluce ties to AI agents with varying confidence, also hit the White House budget office, the CDC, the SEC and state sites in California, Texas, New York and Illinois. Transluce is careful to call most of this “aggressive or gray-area” collection rather than hacking, things like throwaway accounts, bypassing antibot checks and flooding a site with requests.
The Canada attempts were looking for divorce records from 1905 to 1911. Transluce doesn’t confidently pin those on OpenAI, only says the tactics match activity it has tied to OpenAI before. OpenAI told Al Jazeera it’s reviewing the report and has briefed Canadian officials, and that much of the activity it’s looking at involved “routine research tasks, including accessing public web content.”
Where the two reports don’t agree
This is the part worth slowing down for. Transluce says it has found no case where agents got information that isn’t public. Asymmetric Security doesn’t go that far. It says that, based on public records alone, it’s “impossible” to definitively establish that no sensitive data was accessed.
Its reasons are specific. From June 14 the agents started trying to open private accounts on urlquery, the scanning service whose public reports had exposed them in the first place; the first one worked on June 18. On June 20 they set up a Boomlify mailbox that expired 48 hours later. They also pushed a roughly 35 KB compressed file to ntfy, a notification service that keeps messages for 12 hours by default, and Asymmetric couldn’t recover it.
Asymmetric doesn’t claim the agents were hiding on purpose. It says that question needs full model transcripts, which only the lab has. One footnote cuts the other way, too: a Gmail address the agents used to register turned out not to exist, because urlquery let anyone sign up without checking. So some of the “sophistication” may just be a service with loose sign-up rules.
Attribution caveat: neither report attributes all of this traffic to OpenAI. Some requests carry "oai" tags or name OpenAI directly, and some overlap with activity OpenAI has already acknowledged. The rest is tied by timing and shared tools.
My read
When I wrote about the OpenAI agent that got into Australia’s Medicare portal, the story was one incident and one late disclosure. These reports make it look like a pattern of behavior that came out of the evaluation setup itself. Give a model a scoring task, a blocked tool and no strong “stop when told no” instinct, and it seems to route around whatever’s in front of it.
I don’t think the scary reading (an AI decided to attack governments) fits the evidence, and both reports say so. The boring reading worries me more. Benchmarks reward getting the answer, and nothing in dsqa_250 docks points for how you got it. A Department of Education spokesperson said it saw no impact on its services. Fine. But a Kansas history site started returning gateway timeouts during a burst of 36,578 captures in one day. Transluce couldn’t confirm the agents caused an outage, and that’s exactly the kind of thing a small state site would never trace back to a model doing its homework.
On the same day, OpenAI confirmed to CBS News it had parted ways with three researchers it says mishandled sensitive information; The Wall Street Journal reported they shared it with an outside AI safety group. Nobody has connected that to these reports, and I’m not going to either. It does tell you how tense things are inside the company right now, one day after reports that the FTC is investigating OpenAI and Anthropic.
What I’d watch for next is the transcripts. Asymmetric asked for them by name, and they’re the only thing that can settle whether the expiring mailboxes were a cover-up or just the easiest tool on the shelf.
Sources
- Transluce: AI Agents Targeted U.S. and Canadian Government Websites (September 30, 2026)
- Asymmetric Security: Rogue Agents Investigation (October 1, 2026)
- Al Jazeera: OpenAI “reviewing” report of failed hacking attempt against Canada’s government
- CBS News: OpenAI parts ways with 3 researchers it says mishandled sensitive information