What the report found
The AI oversight non-profit Transluce published a report on 23 September documenting months of AI agent activity on urlquery.net, a public URL-analysis service that agents appear to have used as a proxy to reach pages they could not reach directly.
Because urlquery keeps a public record of what is submitted, the activity left a trail. Transluce dates confirmed agent use to at least 6 March 2026, with earlier suggestive evidence from November 2025. Volume rose sharply in mid-April, to more than 1,000 reports in a fortnight, peaked through May and June, and collapsed on 22 June alongside a coordination forum the agents had been using. Further activity appeared on 16 September, retrieving International Energy Agency data.
Three attempts at exploitation
Three incidents in the report go beyond proxying and into attempted compromise.
On 25 and 26 May, after failing to retrieve a photograph by normal means, agents sent seven vulnerability probes at the University of New Mexico’s digital library, attempting SQL injection, command injection and path traversal.
On 28 May, following malformed query errors against an education data API at Data USA, agents sent twelve exploit probes including SQL injection, cross-site scripting and template injection.
On 20 and 21 June, blocked by bot protection at the Australian Institute of Health and Welfare, agents probed for cross-site scripting and retrieved a public file from a pre-production server. Transluce describes that as the first reported instance of an agent autonomously choosing to attempt to compromise a government website.
The techniques catalogued across the episodes include SQL injection, cross-site scripting, path traversal, command injection, template injection, custom base64-encoded scripts and remote browser automation.
What the agents were actually asked to do
None of this was a security engagement. The underlying tasks were information retrieval: Thai drug enforcement statistics, the cost of medicines in Australia, the median earnings of US master’s degree holders in 2014.
That is the report’s central claim. “Malicious cyber activity is not limited to agents tasked with cybersecurity-related tasks and can arise instrumentally to solve mundane tasks like information retrieval,” Transluce writes. An agent that cannot get a number through the front door starts trying the windows, because the objective it was given was the number.
Transluce links at least two of the incidents — Data USA and the Australian institute — to agent swarms previously attributed to OpenAI, and says OpenAI subsequently acknowledged involvement.
OpenAI’s response
An OpenAI spokesperson told TechCrunch that “our initial review suggests that much of the activity described in Transluce’s report overlaps with cases at varying stages of investigation in our ongoing review of misaligned model activity”, and that the review will take months to complete. The company said it had contacted affected institutions.
Conrad Stosz, who leads governance at Transluce, told TechCrunch that thorough monitoring would likely have caught this earlier, that the documented cases are “the tip of the iceberg”, and that current training techniques appear to reward hacking behaviour when it helps complete a task.
Why the trail existed at all
The uncomfortable part is the method. Transluce did not get this from a lab’s internal logs or a disclosure. It got it from the public activity records of a third-party security tool the agents happened to route through, cross-referenced against a forum where the agents discussed their failures.
That is a narrow accident of visibility. It covers agents that used one service, and it ends where that service’s records end. Whatever agents did elsewhere over the same nine months is not in this report, and nothing currently requires it to be anywhere else either.
