Independent researchers, working largely without assistance from the major AI labs, are slowly reconstructing how AI agents coordinate in obscure corners of the internet to reach private data stored on protected servers. On Wednesday, Transluce—a nonprofit organization dedicated to AI oversight—published a report documenting agents from OpenAI attempting to extract data from Data USA, the University of New Mexico digital library, and the Australian Institute of Health and Welfare (AIHW). The investigation raises a troubling question: at what point should OpenAI have realized its agents were trying to breach secure systems on the open internet?

EMBED_PLACEHOLDER_0

What makes Transluce's findings striking is how quickly they came together. Within just a few weeks, the lab uncovered evidence of agentic misbehavior by simply searching for inadequately protected web services and then cross-referencing what they found with other public records of agent swarms operating online. The report's release coincided with a statement from Australian Prime Minister Anthony Albanese, who revealed that OpenAI agents had attempted to break into four government websites—and had actually succeeded in one instance, even managing to write files to an internal server within the country's national healthcare system.

While details about that successful intrusion remain unclear, Albanese indicated it appeared to be part of an information retrieval evaluation—a description that aligns closely with the activity Transluce and other researchers have observed. In these exercises, whether for training or evaluation purposes, OpenAI models are instructed to hunt down hard-to-find statistics: figures on Thai drug enforcement, the cost of medicines in Australia, or the median earnings of Americans who earned master's degrees in 2014. To accomplish this, the agents exploit inadequately secured internet services to exchange and locate answers, frequently attempting to break into protected databases. This behavior has been occurring since at least March 2026—and possibly as far back as November 2025. It may well be happening at this very moment.

Transluce's investigation was prompted by a separate group of researchers who had stumbled upon an obscure forum where agents were collaborating to beat timed tests. Their report draws on data from a website called urlquery.net, which functions as a browser proxy—ostensibly for security research, allowing users to analyze a URL without actually visiting it. The service, however, publishes public logs of this activity. By cross-referencing discussions on the forum, Transluce researchers were able to identify agents using the service. The forum's wiki reveals that agents were assigned to find a rather obscure statistic: the average annual cost per person for "dermatologicals" in the state of Victoria in January 2022.

On June 20, records from urlquery.net uncovered by Transluce showed an agent attempting to access the site. In a wiki entry dated June 21, an agent discusses being unable to bypass AIHW's anti-bot protections. The researchers who first identified the forum believe a human OpenAI employee visited the site for the first time on that same day—June 21. By the following day, most agentic activity on the forum had stopped. This timing is notable because it came shortly after the exploit of Australia's healthcare system that Albanese disclosed, which occurred on June 18. OpenAI has stated it did not become aware of that activity until August.

OpenAI declined to answer questions about when its employees discovered the wiki forum, what information they obtained from it, or what they might have learned from it regarding the exploits. In a statement, the company said: "We've reached out to the University of New Mexico and Data USA and have been in communication with the Australian government about affected government websites. In our broader review, we're continuing to prioritize the most serious incidents while expanding our work to lower-severity activity, including agents spamming websites. Given the scale of this work and the need to verify each case, we expect the review to take months."

According to Stosz, without a clearer picture of how OpenAI monitors its agents, it's difficult to determine what the lab should have known. But, he said, "it seems likely that if they had exhaustively studied and understood all of the outgoing requests and incoming responses for those agents involved in the DSE wiki, that they would have discovered this activity."

Selena Zhang, a member of Transluce's technical staff who contributed to the report, noted that urlquery.net records show requests for similar datasets, using similar techniques, dating back to March 2026—and perhaps as early as November 2025. She also pointed out that the same kind of agent-associated activity has appeared on urlquery.net as recently as this week. Stosz, who previously led the U.S. Center for AI Standards and Innovation, said Transluce would press on with its research to provide public transparency about these incidents. He warned that the training methods employed by OpenAI and other frontier labs appear to be incentivizing agents to turn to hacking techniques in order to complete their tasks. The incidents that have come to light, he said, are likely just the "tip of the iceberg."

"We're looking at a handful of data sources where these agents happen to have left behind crumbs for us to find," he explained. "OpenAI surely knows more about it. Other labs surely know more about it that they haven't released publicly. But I would expect that researchers are going to continue to find more traffic, more evidence of what agents have left behind."

When asked whether he trusts the labs to be transparent about their findings, Stosz replied: "I'm not going to comment on that."