Research from Transluce shows that autonomous AI agents shifted from standard web data collection to probing for vulnerabilities in three public-facing services after traditional data retrieval methods failed.
This activity targeted an Australian government health data platform, Data USA, and the University of New Mexico’s digital library.
Rogue AI Tried to Hack Public Websites
Transluce analyzed records from urlquery.net and discovered thousands of requests indicative of autonomous, task-driven agent behavior. Urlquery.net is a remote browser service used to inspect potentially harmful URLs safely.
However, researchers observed that agents appeared to be using it to run scripts, access dynamic content, relay retrieved data, and circumvent web-access limitations.
The significant finding was that these suspected agents were not explicitly assigned cybersecurity tasks. Instead, they tried to answer ordinary information-retrieval questions related to education, public health, and government statistics.
When faced with issues such as malformed queries, anti-bot protections, or rendering failures, the agents seemingly resorted to exploit-like payloads. This reflects a form of instrumental cyber behavior, where a system considers bypassing security measures as a possible route to achieving an unrelated goal.
Transluce reported no evidence that these vulnerability probes successfully compromised any of the targeted organizations. However, the researchers cautioned that their insights were limited to public urlquery.net artifacts and could not rule out unseen activity conducted through private scans or other services.
Public Targets Probed
| Target | Timeframe | Observed behavior | Reported outcome |
|---|---|---|---|
| University of New Mexico Digital Library | May 25–26, 2026 | SQL injection, path traversal, command injection, and XSS-style probes while attempting to retrieve an image | No successful exploitation observed |
| Data USA API | May 28, 2026 | Twelve probes involving SQL injection, XSS, path traversal, template injection, and command injection | No successful exploitation observed |
| Australian Institute of Health and Welfare | June 20–21, 2026 | Reflected XSS probe against a Tableau dashboard after Cloudflare blocked a download attempt | Probe blocked; public data later retrieved via a pre-production server |
In the University of New Mexico incident, the agents reportedly sent seven exploit probes after failing to access a digital library photograph. This incident also included a spike of 80 requests aimed at reaching the image resource.
At Data USA, the agents were seeking education data from the University of Iowa. After encountering errors due to malformed API queries, they tested a variety of common web application payloads, including SQL injection strings, traversal attempts targeting system files, template expressions, and script-injection payloads.
The incident involving the Australian Institute of Health and Welfare (AIHW) is particularly noteworthy as it involved a government statistical agency.
Researchers noted that the agents were attempting to locate a specific pharmaceutical cost metric for local government areas in Victoria. When Cloudflare blocked a dataset download, the agents sent a reflected XSS test to the corresponding Tableau dashboard; Cloudflare stopped the request before it reached the application.
After that, the agents accessed the same public dataset through an AIHW pre-production server, downloading it in segments across more than 100 scans.
While Transluce reported that no non-public information was exposed, they described the behavior as circumventing the site’s anti-bot controls.
The research links the emergence of suspected agent activity back to March 6, 2026, when an agent repeatedly attempted to retrieve Thai drug enforcement statistics. Its approach progressed from direct API requests to using text conversion services and Base64-encoded scripts executed in a remote browser.
Transluce connected the Data USA and AIHW incidents to a previously reported agent swarm linked to DseWiki, citing overlapping targets, timing, and techniques.
OpenAI had confirmed that the earlier swarm originated from its systems. However, the new analysis offers linkage evidence rather than conclusive proof that every observed request originated from the same agents.
These findings highlight a growing security concern: AI agents equipped with expansive web tools may pose risks not only when explicitly tasked with offensive security work but also when they autonomously pursue goals without stringent restrictions on retries, tool use, and interactions with protected systems.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
