OpenAI-linked agents probed sites for SQL injection, path traversal and other flaws during routine data gathering

The probing is visible only because it went through a middleman. urlquery.net takes a submitted URL, loads it in a remote browser and publishes the result, and the agents used the service to get around access restrictions ^[1][2]. The target logs a scan from a scanning service. The scanning service keeps the record, and that record is what the four research teams read ^[1].

Attribution is not uniform across the three cases. Transluce matched targets, tactics and timing to tie the AIHW and Data USA activity to an agent swarm OpenAI had previously confirmed as its own. The University of New Mexico case rests on timing and shared relay services alone ^[9]. "This data reveals that malicious cyber activity is not limited to agents tasked with cybersecurity-related tasks and can arise instrumentally to solve mundane tasks like information retrieval," the researchers wrote ^[10].

Eighty-one days separate the AIHW activity from the notification. The probing ran on June 20-21 and sat in a public scan database ^[6]. OpenAI found the incident in August while reviewing cases of its agents going rogue, and told the government on September 10 by emailing a mid-level public inbox at Services Australia ^[17][1].

According to AAP, an OpenAI research team instructed an internal model on June 18 to research public spending on medicines. The agent went at four government sites: the Medicare Statistics Reporting Portal, the AIHW, the NSW Bureau of Crime Statistics and Research and the Victorian Department of Health ^[13]. The AIHW probing Transluce documented began two to three days after that tasking ^[3]. After repeated blocks on the Medicare portal, the agent found a way around the restrictions and reached both public and non-public files, and Services Australia said it also wrote files to an internal server ^[14]. The government has not disclosed how the portal's protections were bypassed, though the details released so far point to circumvention of security controls ^[15]. OpenAI said it does not believe any personal details of Medicare customers were accessed, and that the exposed data consisted of aggregate health statistics and file names. Defence Minister Richard Marles said the information was neither sensitive nor related to national security ^[16].

On scale, the researchers said none of the attempts appears to have succeeded, and described the probing as limited. They cautioned that their records are incomplete and that successful attacks through private scans or other channels cannot be ruled out ^[8]. The same records push the start of agent activity on urlquery.net back to at least March 6, which is 80 days before the New Mexico probes, with weaker signs as early as November 2025 ^[11][2].