May 2026 · unauthorised access, scraping, resource misuse

Transluce documents aggressive agent traffic on US and Canadian government websites

Non-profit lab Transluce reports that AI agents used aggressive and grey-area techniques on US federal and state sites and Library and Archives Canada, including disposable emails, reuse of exposed credentials, anti-bot bypasses and request floods. It identified two failed hacking attempts: a SQL injection probe on a Department of Education civil-rights data service and basic attack payloads against Library and Archives Canada. Transluce found no case of agents reaching non-public information.

Note: Activity spans roughly 23 April to 17 June 2026. Transluce does not attribute the traffic as a whole to OpenAI, though some agents self-identified as OpenAI-associated (e.g. 'OpenAI Research' in a BEA registration) and tactics resemble OpenAI-linked activity. The 'up to ~5,600 requests per minute' figure in other summaries corresponds to a 5,594-captures-per-minute peak on a Maryland site on 6 May. The Canadian Centre for Cyber Security said there was no indication of compromise; the Education Department reported no service impact.

reported by researchers · Sources: Transluce (primary) · BleepingComputer