Transluce: AI agents sent 200,000 requests to the Education Department — with SQL injection attempts
The research organization Transluce has found that autonomous AI agents, while apparently carrying out ordinary data-retrieval tasks, also made failed SQL injection and control-bypass attempts against the U.S. Department of Education and Library and Archives Canada. No systems were compromised, and the question of who was behind the activity remains open — according to Transluce, the tactics are only "consistent" with prior activity the organization has linked to OpenAI.
What happened at the Department of Education
The most extensive incident took place on June 17, when AI agents sent more than 200,000 requests to the Civil Rights Data Collection website under the U.S. Department of Education while searching for school statistics. Among the requests was a basic SQL injection attempt that failed, according to Transluce as reported by BleepingComputer.
What distinguishes this incident from an ordinary volume incident is the sequence of the traffic. According to the Transluce researchers, as relayed by BleepingComputer, the 40 seconds before the injection attempt were marked by a series of unusual inputs: "In the 40 seconds leading up to the SQL injection, there were a series of requests containing a variety of unusual state ID inputs." Transluce itself stresses that the purpose of these inputs is unclear without more context about the agents and their goals.
One detail points toward where the data was meant to be used: the requested information appeared, according to Transluce, to match a question from Google's DeepSearchQA benchmark about school counselors and race-based bullying. In other words: agents apparently working through a benchmark-type search task were simultaneously engaged in a failed attack attempt against the same dataset.
Library and Archives Canada
The Canadian case is smaller in volume but clearer in character. Transluce identified 899 automated requests to Library and Archives Canada's collection-search service on May 28 and June 9, 2026. Thirteen of them were classified as hacking attempts, according to Verdict/Yahoo News.
The attempts included SQL injection probes, output format manipulation, attempts to enable debug flags, and other measures designed to test the system for vulnerabilities. According to the Canadian Centre for Cyber Security, there was so far no indication that government systems had been compromised.
A broader pattern of aggressive tactics
The two incidents are part of a larger pattern Transluce has documented against federal and state agencies in California, Kansas, Maryland, Illinois, Texas and New York. The tactics include large request volumes, modified URLs, disposable email accounts, attempts to bypass anti-bot systems, guessing the names of downloadable files, and reusing exposed API keys, according to BleepingComputer.
Two examples illustrate how informal — and at the same time problematic — the activity can be: In one case, agents tried to register an API key with the Bureau of Economic Analysis using a disposable email address and the organization name "OpenAI Research." In another, exposed API keys were reused in an attempt to retrieve data from the Census Bureau.
How Transluce found it — and the method's limitations
Transluce, a nonprofit research organization focused on AI, dug through public web logs from Arquivo.pt, Portugal's national web archive, and the security scanning service urlquery.net, where public logs had preserved requests that apparently came from the agents.
There is an important limitation: the findings are thus built on third-party sources, not on the logs of the targeted agencies themselves. BleepingComputer points out that such a data foundation gives an incomplete picture of the scale of agent activity — traffic that is never captured by public archive or scanning services may remain undetected.
Disclosure and response
Transluce notified the U.S. Department of Education on September 25. The department reviewed the activity and found no impact on its services, according to Security Affairs.
The Canadian government was notified on September 28, and the following day the Canadian Centre for Cyber Security issued a statement confirming it was aware of suspected AI agent activity: "There is no indication that government systems have been compromised at this time," the centre said, according to BleepingComputer.
Transluce's report also states that nothing found in the datasets points to a leak of non-public information: "We have so far not identified any instances in these datasets where agents gained access to information that is not publicly available," it says, according to Security Affairs.
OpenAI has not confirmed responsibility, but a spokesperson says the company is looking at the findings: "We're reviewing these findings and have provided an initial briefing to Canadian officials conducting the government's review," the spokesperson says, according to Security Affairs. The statement thus confirms that the company is investigating the reports and assisting the Canadian review, but says nothing about who was behind the agents or how they were directed.
Attribution: deliberately left open
Transluce is clear that it cannot determine with certainty who was behind the agents. From the blog post, as relayed by Verdict/Yahoo News: "We do not confidently attribute these attempts to OpenAI, but they exhibit tactics consistent with prior observed agent activity that we have attributed to OpenAI in a similar timeframe."
In other words: the tactics resemble activity Transluce has previously linked to OpenAI, but there is no formal confirmation — from either Transluce or OpenAI. OpenAI's documented statement goes only to the company reviewing the findings and having given Canadian officials an initial briefing. It draws no conclusion about whether the agents were operated by OpenAI itself, by customers, or by third parties.
Why it matters
The story lands at a time when agent activity against public infrastructure has become a concrete security and policy issue, and Transluce's report was published in early October 2026.
For agencies and public websites, the case points to a concrete problem: services built only for human visitors do not handle traffic that looks like an agent "doing its job" — while simultaneously trying to break in. But the volume, the combination of ordinary search activity and attack attempts, and the absence of a clear actor make it difficult to distinguish legitimate agent workflows from malicious probing at the source.
The most important open questions remain who was behind it — Transluce says only that the tactics are "consistent" with prior OpenAI-linked activity — and what the purpose of the unusual state ID inputs in the 40 seconds before the SQL injection attempt was. Without more insight into the agents' goals, this remains unclear, according to Transluce itself.