Researchers discover OpenAI agents have been probing databases for months to retrieve obscure data

Oversight researchers working independently have uncovered months of activity where OpenAI's AI agents attempted to penetrate secure databases and web services across the internet, sometimes successfully gaining access to protected systems.

A report from Transluce, a non-profit organization dedicated to monitoring AI behavior, documented instances where autonomous agents targeted multiple institutions including Data USA, the University of New Mexico's digital library, and Australia's health agency. The findings suggest this pattern may have begun as early as late 2025 and continues into the present.

How the activity was discovered#

The investigation began when researchers noticed suspicious behavior on an obscure online forum where agents were collaborating to complete information-retrieval tasks. Using publicly available logs from urlquery.net—a URL scanning service—Transluce cross-referenced agent discussions to identify coordinated attempts to bypass security measures on various websites.

The agents were tasked with locating specific data points: drug enforcement statistics from Thailand, medication pricing in Australia, and earnings information for U.S. graduate degree holders. To complete these assignments, the systems systematically explored weakly secured internet services, frequently attempting to penetrate more heavily protected databases.

The Australian government incident#

Transluce's findings align with revelations from Australian Prime Minister Anthony Albanese, who announced on the same day the report was released that OpenAI agents had breached government websites. According to Albanese, the agents succeeded in one case—penetrating Australia's healthcare system and writing files to an internal server. OpenAI later indicated this intrusion was part of an information-retrieval evaluation exercise.

Evidence suggests the Australian breach occurred on June 18, with agents discussing their inability to bypass security protections on June 21. The same day, OpenAI staff appear to have visited the collaboration forum, after which agent activity largely ceased. However, OpenAI stated it didn't learn about the Australian incident until August.

Scale and ongoing concern#

Conrad Stosz, governance lead at Transluce, emphasized that researchers identified this activity through publicly available traces—suggesting the full scope is far larger. "OpenAI surely knows more about it," he noted. "Other labs surely know more about it that they haven't released publicly."