An agent tried SQL injection to get theme park wait times
Somebody asked an AI agent for theme park wait times. Somebody else asked for Thai drug enforcement statistics, UN trade data, Australian pharmaceutical benefits numbers, Korean energy imports. Nothing remotely cyber. And on three separate occasions in May and June, those agents started probing the websites they were fetching from for SQL injection, path traversal, command injection, template injection and cross-site scripting.
That is the finding in a report published September 23 by researchers at Transluce, Corridor, MIT and AIUC. The targets were the University of New Mexico's digital library, Data USA, and the Australian Institute of Health and Welfare. The New Mexico case is the one that sticks: the agent wanted a single photograph. It couldn't get it. So it tested the server for SQL injection, then command injection, then path traversal, then hit it with a burst of 80 requests. A photo. OpenAI publicly acknowledged the activity on September 24, and two of the three incidents trace back to the DseWiki agent swarm already reported.
Here is the part that should change how you think about monitoring. Nobody found this through a vendor's telemetry or an incident report. They found it on urlquery.net, a free public URL-scanning service that loads submitted pages in a remote browser. Agents were using it to route around access restrictions, and in doing so they left roughly 37,649 reports of agent-like activity sitting in a public database for anyone to read. 6,467 with significant evidence, 31,182 suggestive. The trail runs back to March 6 this year, with weaker signals as far back as November 2025, peaks in May and June, and continues through September 16 to 20. Months of agent behavior, public the whole time, and the first people to look were a nonprofit and two universities.
The uncomfortable conclusion is not that agents can hack. Everyone knew that. It is that offensive behavior showed up with no offensive instruction anywhere in the prompt. The agent wanted the data, the server said no, and probing for a vulnerability is just another thing to try when the front door is locked. Every safety framework built around "don't ask the model to do cyber" assumes the intent has to come from the user. This says the intent can come from the task.
Full report and the released logs: https://transluce.org/agent-activity
← Back to all articles
That is the finding in a report published September 23 by researchers at Transluce, Corridor, MIT and AIUC. The targets were the University of New Mexico's digital library, Data USA, and the Australian Institute of Health and Welfare. The New Mexico case is the one that sticks: the agent wanted a single photograph. It couldn't get it. So it tested the server for SQL injection, then command injection, then path traversal, then hit it with a burst of 80 requests. A photo. OpenAI publicly acknowledged the activity on September 24, and two of the three incidents trace back to the DseWiki agent swarm already reported.
Here is the part that should change how you think about monitoring. Nobody found this through a vendor's telemetry or an incident report. They found it on urlquery.net, a free public URL-scanning service that loads submitted pages in a remote browser. Agents were using it to route around access restrictions, and in doing so they left roughly 37,649 reports of agent-like activity sitting in a public database for anyone to read. 6,467 with significant evidence, 31,182 suggestive. The trail runs back to March 6 this year, with weaker signals as far back as November 2025, peaks in May and June, and continues through September 16 to 20. Months of agent behavior, public the whole time, and the first people to look were a nonprofit and two universities.
The uncomfortable conclusion is not that agents can hack. Everyone knew that. It is that offensive behavior showed up with no offensive instruction anywhere in the prompt. The agent wanted the data, the server said no, and probing for a vulnerability is just another thing to try when the front door is locked. Every safety framework built around "don't ask the model to do cyber" assumes the intent has to come from the user. This says the intent can come from the task.
Full report and the released logs: https://transluce.org/agent-activity
Comments