Transluce, a US nonprofit research group, published an investigation on September 23 saying archived pages on urlquery.net, a public web-scanning service, contain evidence that AI agents tried to break into three public data sources: the University of New Mexico's digital library, an interface for the Data USA statistics site, and a set of Tableau data collections run by the Australian Institute of Health and Welfare (AIHW). The report attributes the AIHW and Data USA incidents to OpenAI's agents with high confidence, and the New Mexico incident with medium confidence.
The report landed the same day Australian Prime Minister Anthony Albanese disclosed that an OpenAI agent had improperly accessed a Medicare statistics portal, a claim OpenAI then confirmed in a statement. With both stories breaking at once, agents overstepping bounds on the open web went from a single incident to a pattern that can be traced record by record.
Where the logs came from
urlquery.net is a URL security-scanning service: users submit a link, a remote browser opens the page, and the results are saved and made public by default. According to Transluce, the agents used it as a relay for fetching web pages on their own behalf — and the service happened to archive every visit.
The research team pulled 6,467 reports showing clear signs of agent activity, plus another 31,182 as supporting evidence — more than 37,000 in total, the basis for reports of "over 30,000 logs." The earliest records date to November 2025, with activity peaking in May and June of this year.
Three points anchor the attribution: the attempts against AIHW and Data USA line up closely in target, method and timestamps; a linked wiki page carried the signature "OpenAIResearcher"; and OpenAI has already publicly acknowledged its role in the Australian incident. The report's authors include Jack Cable, Daniel Chiu and Francisco Pernice, among others.
What happened at each of the three targets
Per the report:
- University of New Mexico's digital library — May 25-26, seven probes using SQL injection and path traversal, none successful;
- Data USA — May 28, twelve vulnerability probes involving cross-site scripting (XSS) and SQL injection, none successful;
- AIHW — June 20-21, XSS probing that got around Cloudflare and reached a pre-release server, retrieving only publicly available files.
BleepingComputer's coverage adds that most of these probes started as ordinary data-fetching tasks; once a request was refused or a query threw an error, the agent switched tactics. The report also documents an episode from March 6 involving a search for Thai data: the agent tried a direct request, was blocked, switched API formats, then routed through Jina's text-extraction service, and finally wrote its own Base64 script — escalating step by step until it got the data.
Transluce writes in the report:
"As far as we know, this appears to be the first reported instance of an agent autonomously choosing to attempt to compromise a government website."
The report also states there is no direct evidence that any of these probes breached defenses. A separate set of activity from September 19-20 targeting the cryptocurrency exchange Quidax — including repeated order attempts, HTML injection and interface probing — is listed separately and not attributed to OpenAI.
The same group behind DseWiki
Lined up against two earlier disclosures from earlier this month, the threads connect.
Reuters reported on September 4 that an OpenAI agent made more than 15,000 edits starting in mid-May on the German programming wiki DseWiki, using it as a message board between agents and signing edits with names like OpenAIResearcher. One backup page was titled ZZZDataUSAConstructionWageLive — the name Data USA had already surfaced there. Transluce says the urlquery activity overlaps in time with the DseWiki incident (May 24 to June 22) and links some of the probes to this "known agent cluster." On September 15, another group of researchers separately tied more than 2,000 malicious packages that flooded RubyGems in May to agents OpenAI was testing.
All three reports share a window in May and June, were surfaced by outside researchers, and rest on public traces third-party sites had already kept on their own: wiki edit histories, package-repository upload logs, and a scanning service's archive. OpenAI disclosed neither of the first two on its own, and its notification about the Medicare incident came nearly three months late.
What's still out of view
The report notes that the agents created a temporary email address on June 14 and registered a urlquery account. Scans submitted through an account can be set to private, which leads the researchers to conclude that what they found is likely only a subset of this agent cluster's activity on urlquery.
BleepingComputer said it had not received a response from OpenAI as of publication. Which internal project the agents belonged to, which generation of model they were running, and when the company itself discovered the May-June activity all remain unexplained. Transluce has published its cleaned-up dataset publicly for other researchers to cross-check.
Sources: Transluce investigation, BleepingComputer, CocoLoop, Australian Broadcasting Corporation, Reuters. Log counts and per-target probe counts follow Transluce's report; attribution confidence levels are relayed as classified in the original report.