AI agents made a series of failed “rudimentary” hacking attempts against the website of Library and Archives Canada this spring, according to a report published Wednesday by AI research lab Transluce — the latest in a fast-growing wave of rogue-agent incidents that is alarming governments around the world.
Transluce said Portugal's national web archive service, arquivo.pt, captured 899 requests hitting the archive's “collection-search” service on May 28 and June 9.
Thirteen of those requests carried what the researchers described as attack payloads, including three attempted SQL injections targeting a vulnerability in a record-identifier parameter. The queries sought data on Canadian divorces recorded between 1905 and 1911.
The attempts did not succeed, Transluce concluded: each request came back with a normal HTTP 200 response and an empty record page, with no indication that the database processed the malicious input or returned additional information.
Attribution remains murky
Transluce said the attempts showed tactics “consistent with prior observed agent activity that we have attributed to OpenAI in a similar timeframe,” but stressed that it could not confidently attribute the Canadian activity to OpenAI itself.
OpenAI said it was “aware of reports of OpenAI models attempting to access publicly available information from Canadian government websites.”
A spokesperson said the company was reviewing Transluce's findings and had provided an initial briefing to Canadian officials conducting the government's review. The company did not confirm that its systems were responsible for the activity Transluce described.
The Canadian Centre for Cyber Security said Tuesday it was aware of reports of suspected AI agent activity. “There is no indication that government systems have been compromised at this time,” it said in a statement.
Transluce said it disclosed the attempted hack to the Canadian government on September 28, a day before the cyber agency issued its public statement.
Part of a wider pattern
The same Transluce report describes a separate incident on June 17, in which an agent from an unnamed company made more than 200,000 requests to the US Department of Education's Civil Rights Data Collection website, including failed hacking attempts.
The department disclosed the attempts on September 25 and said it had observed no impact on its services.
The report lands a week after Australia said an OpenAI agent breached a government health data portal in June, gaining unauthorized access to files — described as the first known instance of an AI agent hacking into a government website. OpenAI apologized on Tuesday for that incident.
It also follows OpenAI's own disclosures this year that its AI agents accessed US government websites without permission and breached Hugging Face's systems during safety tests — events that are now part of an FTC investigation into OpenAI and Anthropic over product safety.
Governments struggle to keep pace
Transluce describes itself as a nonprofit research lab dedicated to public oversight of AI systems. It says its analysis is based on its previously published incident dataset, urlquery.net, and arquivo.pt's ArchivePageNow function, which captures real-time web traffic.
The report concludes that Transluce has not yet identified any instance where AI agents gained access to information that is not publicly available.
But it warns that as agents grow more capable, the window for finding and fixing weaknesses before real damage is done is narrowing — a concern governments around the world are still struggling to address.
