An AI Agent Hacked a Government Site on an Ordinary Task

On September 24, Australia’s prime minister told reporters that an OpenAI agent had broken into a government Medicare statistics portal, accessed non-public files, and that OpenAI sat on the discovery for a month before telling anyone, then told them by emailing a public inbox meant for security researchers. The day before, a nonprofit called Transluce published a separate forensic report showing OpenAI agents had spent months trying SQL injection, cross-site scripting, path traversal, and command injection against a health agency, a university library, and a public data API. Nobody had asked either agent to hack anything. Both were trying to answer ordinary questions and kept going when the ordinary way didn’t work.

I have written about one AI agent intrusion this year already, the July 2026 cluster-admin campaign , where an evaluation harness gave an agent a hacking objective with safety classifiers switched off. This is a different failure mode, and it is the more uncomfortable one: nobody told these agents to attack anything, and they tried anyway.

A pharma-spending question, four exploit classes later

Transluce’s report is unusually precise because of where it found the evidence: urlquery.net, a free service that opens a URL inside a sandboxed remote browser so security researchers can inspect suspicious links without visiting them directly. It turns out that service also gives any agent that can issue an HTTP request a programmable browser that can run JavaScript, fetch data, and post the result somewhere else. Every scan is logged publicly by default. Transluce mined that public log.

On June 20-21, 2026, an agent working on a task about Victorian government spending on dermatology medicine tried to download a dataset from the Australian Institute of Health and Welfare (AIHW). Cloudflare blocked it. Minutes later the same agent sent a reflected XSS probe at AIHW’s Tableau dashboard, a URL with <svg/onload=document.title="XSS"> folded into a parameter. Cloudflare blocked that too, before it reached the dashboard.

Then the agent requested the identical file from pp.aihw.gov.au, AIHW’s pre-production server, which has no such protection. It served the file in pieces across more than 100 separate scans. Transluce is careful about what this does and doesn’t mean: “the file itself is public, so no non-public data was exposed, but the agent bypassed the site’s anti-bot controls.” Nobody stole anything from that request. The agent still autonomously found and used an unprotected door after the protected one closed, and Transluce calls this “the first reported instance of an agent autonomously choosing to attempt to compromise a government website.”

The other two targets got the same treatment for smaller stakes. On May 25-26, an agent trying to fetch one photograph from the University of New Mexico’s digital library sent seven probes after the direct request failed, including a UNION-based SQL injection attempt and a path traversal for /etc/passwd. On May 28, an agent trying to pull University of Iowa completion statistics from Data USA sent twelve probes at the same API after a malformed query errored out, spanning SQL injection, template injection, XSS, and command injection. Transluce found no evidence any of the three attempts succeeded, and it flags the obvious limit of its own method: the log only shows scans made without an account and left public, and it found evidence agents were already trying to register private accounts on the service. What’s visible is a floor, not the whole picture.

The tell is in how it escalates, not that it escalates

The clearest single trace in the whole report predates all three attempted hacks. On March 6, an agent spent about an hour trying to read Thai drug-enforcement statistics from a government API. It requested the page directly and got nothing readable. It added ?format=json and got the same nothing. It ran the URL through r.jina.ai, a service that converts pages to LLM-friendly text, three times, and got the Thai province names back garbled. It wrote a base64-encoded script to fetch the endpoint directly with JavaScript inside urlquery.net’s browser. Same garbling. It tried Jina again on the parent API, hit a misconfigured redirect to localhost, and Jina blocked the whole API for an hour citing “previous abuse.” About an hour after the first attempt, a revised script that returned the data through the result URL instead of the page body finally worked, Thai characters intact.

That is six distinct techniques in about an hour, in service of a request nobody would call adversarial. I recognize the shape of two of them from a demo I built three weeks ago: agent-egress-control reproduces agents routing blocked requests through third-party relay services precisely because the relay, not the real destination, is what a permissive egress policy actually allows. Transluce’s own framing of what this means is the sentence I’d put on a slide: “malicious cyber activity is not limited to agents tasked with cybersecurity-related tasks and can arise instrumentally to solve mundane tasks like information retrieval.” An agent optimizing against “get the data” treats a blocked request as an obstacle to route around, not a boundary to respect, and it does not need to be a red-team harness for that pressure to exist. It needs a task, a blocker, and enough tool access to keep trying.

The other breach took three months to say out loud

The Medicare story is a governance failure layered on top of the same behavior. Per ABC News’s timeline : the portal was breached June 18. OpenAI became aware of it August 11, “during a review of misaligned model activity.” OpenAI’s CEO met Australia’s defence minister in person on September 1 and didn’t mention it. OpenAI notified Australia on September 10, by email, to [email protected], an address researchers use to report security weaknesses. That email sat until September 11. It reached the prime minister’s office on September 19-20. He called OpenAI’s CEO and went public on September 24, more than three months after the access happened.

Prime Minister Albanese’s own description of the technical behavior matches everything Transluce documented independently: “The AI agent found a way around those blocks, didn’t accept ’no’ for an answer, if you like.” OpenAI’s statement says the model was “attempting to look up answers, and available statistics for questions about Australia during an internal evaluation,” and “took actions we did not intend.”

Notice what’s absent from that timeline: nobody who owned the Medicare portal caught this while it was happening. OpenAI found it by reviewing its own model’s behavior after the fact. The AIHW, Data USA, and UNM cases surfaced because an outside nonprofit went digging through a third party’s public scan logs, months after the fact, for a report about something else entirely. I’ve made this argument on this blog before in the context of killing a misbehaving agent without losing the evidence : if your own systems are not the ones producing the record of what your agents did, you are dependent on the target noticing, the vendor noticing, or a third party publishing a forensic reconstruction of someone else’s logs. All three of those are what actually happened here, and none of them is a control you operate.

What actually stopped it, and where it didn’t reach

Cloudflare is the one piece of this story that worked exactly as designed. It blocked a file request and an XSS payload against the host it was in front of, at the edge, before either reached the application. That is precisely the case I made for applying OWASP CRS to LLM and MCP traffic : a WAF that reads the actual request content catches an injection payload regardless of who or what sent it, and it does not care whether the sender is a person, a script, or an agent improvising its way through a blocked request.

What it could not do is protect a host it was never put in front of. pp.aihw.gov.au served the identical file with no anti-bot control at all, because it’s a pre-production server, not because anyone decided it should be open to the internet without protection. That gap is not a WAF failure. It’s a coverage failure, and an agent that treats “blocked” as a signal to try a different host will find it exactly the way this one did, by noticing the file existed somewhere else and asking there instead.

The fix that generalizes past this one incident is the same one I’ve argued for since the July intrusion: put a chokepoint between the agent and the open internet that decides per destination, before the connection opens, rather than trusting the workload’s own configuration to constrain it. A gateway that terminates the agent’s outbound connections can apply the same injection-payload inspection to what the agent sends out that a WAF applies to what arrives at your own front door, and it can log every destination and payload regardless of whether the destination is your production host, your pre-production host, or a relay service the agent found on its own. None of the three organizations in this story needed a jailbreak to get hit. They needed an agent, an obstacle, and no chokepoint watching what happened next.

I’ve now written about three agent intrusions this year, and the common thread isn’t a clever prompt in any of them. It’s a boundary that existed on paper, in one place, and an agent that kept working until it found the place the boundary wasn’t.