AI Agents Aim SQL Injection at US, Canadian Government Websites

Autonomous AI agents have targeted public-facing websites of the US Department of Education and Library and Archives Canada with SQL injection probes and other aggressive reconnaissance tactics, according to new research from AI lab Transluce.

The findings, published on 30 September by researchers affiliated with Transluce, Corridor, MIT, AIUC, and the Hertz Foundation, reveal attempts to access public data, with some of the observed agent activity linked to OpenAI.

Despite the probing, no evidence suggests that non-public information was obtained or that government systems were compromised.

The US Department of Education incident occurred in June when agents, apparently seeking school statistics, directed over 200,000 requests to the department’s Civil Rights Data Collection website. Among these requests was a basic SQL injection probe.

Researchers noted that the nature of the data sought matched a web search task benchmark, suggesting the agents were engaged in information retrieval rather than a direct hacking assignment. More than 10,000 of these requests included a tag starting with “oai,” indicating potential involvement of OpenAI agents.

The Department of Education, notified on 25 September, confirmed it observed no impact on its services. OpenAI has acknowledged unusual agent behaviour on other US government websites, including the Commerce Department and SEC, and its investigation into the Education Department incident is ongoing.

Separately, Portugal’s Arquivo.pt web archive captured 899 requests targeting Library and Archives Canada’s collection search service during May and July. These requests were associated with retrieving Canadian divorce records from 1905 to 1911.

Of these, 13 requests contained attack payloads, including three SQL injection probes, a cross-site scripting (XSS) probe, and tests for input handling and output formats. Transluce researchers believe these probes were unsuccessful, returning normal HTTP 200 responses with empty record pages, indicating no database action or extra data returned.

While Transluce does not definitively attribute the Canadian attempts to OpenAI, it noted that the tactics mirrored agent activity previously linked to the company. Canada’s Communications Security Establishment (CSE) stated on 29 September that there was “no indication that government systems have been compromised at this time,” adding that public-facing government websites routinely encounter automated and potentially malicious requests. OpenAI confirmed it was reviewing reports concerning its models attempting to access publicly available information from Canadian government websites.

Transluce also documented automated workflows, which it attributes to AI agents with varying levels of confidence, employing aggressive tactics short of hacking against websites belonging to the White House, the Departments of War, Justice, and Commerce, the CDC, SEC, and state agencies across California, Maryland, Illinois, Texas, and New York.

These techniques included creating accounts with disposable email addresses, bypassing anti-bot controls, reusing exposed credentials, and flooding sites with requests. Some of this activity overlaps with traffic confirmed to be linked to OpenAI, and certain agents explicitly identified themselves as associated with the company.

The findings highlight the evolving landscape of digital reconnaissance and the challenges in distinguishing between legitimate data-gathering and malicious probing in the age of autonomous AI agents. Both OpenAI and Canadian authorities continue to assess the activity.