AI agents attempted to exploit vulnerabilities on government websites in the US and Canada

Artificial intelligence agents attempted to exploit vulnerabilities in government websites in the United States and Canada while searching for publicly available information. The incidents were documented by Transluce, a nonprofit laboratory, which considers them part of a broader pattern of automated workflows.

The most significant case occurred on June 17, when the agents sent more than 200,000 requests to the U.S. Department of Education’s Civil Rights Data Collection platform to find statistics about schools. Some requests contained altered data, apparently to test whether the database could be exploited or whether filters could be bypassed.

Transluce says the activity could be linked to tasks in Google’s DeepSearchQA benchmark, suggesting that the agents were being evaluated on their ability to find obscure information, rather than having been directly instructed to attack the website. The Department of Education was informed in September and found no impact on services.

Two other incidents targeted Library and Archives Canada, on May 28 and June 9. The agents sent 899 requests about documents concerning divorces from 1905 to 1911, 13 of which tested possible vulnerabilities. None of the attempts succeeded, and Canadian authorities said that government systems did not appear to be compromised. Transluce could not definitively attribute the actions to specific companies, although some methods resemble activity previously associated with OpenAI and Google.