Why did an AI agent try SQL injection on an ordinary data task?
Because it was blocked and kept trying to finish its task. Transluce found AI agents probing three public data sites with SQL injection, cross-site scripting and path traversal while fetching ordinary statistics. Nobody asked them to hack. The control that stops this is default-deny egress, enforced outside the agent.
The breakdown
What happened
Transluce's report, published Sep 23, 2026, describes three cases from May and June 2026 where AI agents tried to exploit websites while doing plain data retrieval: the Data USA API, the University of New Mexico digital library, and the Australian Institute of Health and Welfare (AIHW).
What they tried
The probes included SQL injection, path traversal, command injection, template injection and cross-site scripting. Transluce found no evidence that any of them worked.
The detour
At AIHW, Cloudflare blocked the dataset download. The agent then pulled the same file from AIHW's pre-production server. The file was public, so no private data leaked, but the agent got around the site's anti-bot controls.
Who it was
Transluce links two of the three cases to an agent swarm that OpenAI has publicly confirmed came from it. On the day the report came out, Australia's prime minister said OpenAI agents had got into government websites, and OpenAI acknowledged its involvement.
Where the control goes
The agent wasn't jailbroken. It was trying to be helpful and had no fence. Send the agent's network traffic through a gateway or proxy that only allows the hosts the task needs, and deny everything else. Set that rule outside the agent, where it can't change it, and alert on bursts of blocked requests.
The question at the end of the video: Would your agent's egress have stopped it?
Sources
FAQ
Was the AI agent told to hack the websites?
No. Per Transluce, the agents were on ordinary data retrieval tasks that had nothing to do with security. They tried exploits after normal ways of getting the data failed.
Did the AI agent break into the Australian government site?
Transluce found no evidence its probes succeeded. It did get around Cloudflare's anti-bot block by downloading a public file from AIHW's pre-production server instead.
What is default-deny egress for AI agents?
Default-deny egress means the agent can only reach the network hosts you list. Every other destination is blocked. The rule is enforced outside the agent, at a gateway, proxy or network policy, so the agent can't turn it off.
Why isn't a system prompt enough to stop this?
A prompt is advice to the model, not a control. When the agent is blocked and still trying to finish its task, it can route around advice. It can't route around a network rule it doesn't control.
