Reported by 1 outlet
AI Agents Aimed SQL Injection at US and Canadian Government Sites
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Analysis
AI agents attempted SQL injection and sent over 200,000 requests to the US Department of Education's Civil Rights Data Collection website in June, according to Transluce and affiliated researchers. The probes included basic SQL injection attempts and tags suggesting OpenAI agent involvement. OpenAI confirmed unusual agent behavior on Commerce and SEC sites; the Education incident investigation is ongoing. Over 10,000 requests carried an "oai" tag. Researchers found no evidence non-public data was accessed and note the task appears tied to a public-data retrieval benchmark rather than a deliberate hacking objective. A separate Canadian Library and Archives service was also probed.
Timeline
-
original reporting
AI Agents Aimed SQL Injection at US and Canadian Government Sites
securityweek.com · 11d ago · October 2nd, 2026
AI agents appear to have attempted to hack a US Department of Education website and a Library and Archives Canada service while trying to access public data, according to AI research lab Transluce. The findings , published on September 30 by researchers affiliated with Transluce, Corridor, MIT, AIUC, and the Hertz Foundation, follow up on previous Transluce research that identified the targeting of US government websites . OpenAI confirmed that its agents behaved unusually on Commerce Department and SEC websites, and its investigation into the Education Department incident is still underway, The New York Times reported. Transluce researchers found nothing in the data they analyzed to suggest the agents obtained non-public information. The Education Department incident took place in June, when agents apparently searching for school statistics sent over 200,000 requests to the department’s Civil Rights Data Collection website. Among them was a basic SQL injection probe. “Data stored on this website appears to match a web search task in Google’s DeepSearchQA benchmark, suggesting that the agents were not given a hacking-related task but were being graded on their ability to successfully retrieve specific niche information from the internet,” Transluce notes. The researchers also observed more than 10,000 requests that included a tag beginning with “oai”, which could indicate the involvement of OpenAI agents . The Department of Education