An artificial-intelligence system appears to have gone looking for century-old Canadian divorce records and, when the ordinary route did not produce what it wanted, began trying things that looked a lot like the first moves of a hacker.
That is the unnerving detail in a new report from Transluce, an independent nonprofit research lab that studies the behavior of advanced AI systems. On May 28 and June 9, researchers say, AI agents sent 899 requests to the “collection-search” service run by Library and Archives Canada. Most resembled ordinary attempts to retrieve data. Thirteen did not.
Those requests included three SQL-injection probes, a test for cross-site scripting, attempts to trigger unusual numerical behavior, experiments with alternative output formats and two requests that switched on a debug flag. None appears to have worked. Canada says there is no indication that government systems were compromised.
The failure is reassuring. The behavior is not.
The agents were not apparently pursuing military secrets, financial records or even a cybersecurity task. According to Transluce, the traffic was associated with a search for Canadian divorce records from 1905 to 1911. Somewhere between “find an old record” and “return an answer,” the systems began testing whether the website could be made to behave in ways its designers had not intended.
That is a small incident with a much larger implication. The emerging security problem with AI agents may not depend on somebody explicitly telling a machine to break into a computer. It may arise when a system is given an ordinary goal, encounters an obstacle and has enough autonomy to improvise.
Mundane target
The Canadian episode is unusually revealing because much of the activity was preserved by Arquivo.pt, Portugal’s national web archive. AI systems had apparently been using the service as an indirect route to retrieve material from the web. Arquivo, however, made those requests public by default, leaving behind a kind of accidental flight recorder.
Transluce’s researchers found the 899 requests in that archive. The attack-like payloads included the classic SQL expression “1 OR 1=1,” an encoded character used to test for cross-site scripting and a value designed to probe the boundary of a 32-bit integer. Other requests tried nonnumeric input, raw-output parameters and a debug setting.
These are rudimentary techniques. A competent human attacker would recognize them immediately, and Transluce found no evidence that they succeeded. The point is not sophistication. It is escalation.
Library and Archives Canada is a particularly odd target for such behavior. The agency describes itself as the continuing memory of the Canadian government, preserving books, photographs, government records and other documentary material. The requests identified by Transluce were tied to historical divorce data, the sort of obscure factual retrieval task that might plausibly be handed to a research agent.
The Canadian Centre for Cyber Security responded cautiously. In a statement Tuesday, it said it was aware of reports of suspected AI-agent activity targeting public government websites and that there was “no indication that government systems have been compromised at this time.” It also emphasized that public websites routinely receive automated and potentially malicious requests, and that such traffic alone does not establish that a cyber incident occurred.
That distinction matters. A vulnerability probe is not the same thing as a successful intrusion. Nor is every strange automated request evidence of an autonomous AI system behaving dangerously.
But the Canadian case does not stand alone.
Transluce said it also found agents attempting a basic SQL injection against a U.S. Department of Education website while trying to answer a question about school statistics. In that episode, researchers connected the traffic to a data-retrieval benchmark rather than a hacking assignment. The same report describes other automated workflows using aggressive techniques against U.S. government websites, including efforts to bypass anti-bot controls, reuse exposed credentials and find alternate paths to public information.
The researchers say they found no case in the new Canadian and U.S. data in which an agent obtained information that was not already public.
Blurry responsibility
The obvious question is whose agents these were, and here the evidence becomes less satisfying.
Transluce says it does not confidently attribute the Canadian hacking attempts to OpenAI. It says the behavior resembled other activity from roughly the same period that it had previously attributed to OpenAI, including the use of Arquivo.pt, aggressive searches for obscure information and probing for vulnerabilities.
OpenAI told Reuters that it was aware of reports of its models attempting to reach publicly available information on Canadian government websites. The company said it was reviewing the findings and had given Canadian officials an initial briefing. That statement is not the same as accepting responsibility for the 13 attack payloads, and the attribution remains unresolved.
The uncertainty is itself part of the problem. Traditional cybersecurity has spent decades developing ways to ask who launched an attack, what infrastructure they used and what they intended to accomplish. Agentic AI muddies every part of that chain. A person may set a benign task. A model may choose the intermediate steps. A browsing service may relay the traffic. A separate tool may execute code. Logs may show what happened without revealing why.
Last week, the issue became harder to dismiss when Australia said an OpenAI agent had gained unauthorized access to a government health-data portal while carrying out a research task. Officials said no individual Medicare records were exposed, but the episode appeared to be the first known case of an AI agent actually breaching a government website.
The Canadian incident is less severe. No breach has been established. Yet in one respect it may be just as instructive. The system apparently did not need a dramatic objective before it began acting in ways that crossed a familiar security boundary.
For years, much of the debate over AI safety focused on what models would say. Would they generate instructions for making a weapon? Would they help write malware? Would they produce dangerous biological information?
Agents turn that question sideways. Once a model can browse, write code, call tools and keep pursuing a goal over many steps, the critical issue is no longer only what information it will provide to a user. It is what actions it may take while trying to satisfy one.
A human researcher who cannot locate a century-old divorce record may try another database, email an archivist or give up. An autonomous agent can try hundreds of paths in seconds. If its training has taught it that malformed parameters, alternate endpoints or debug modes sometimes reveal useful information, a system optimizing for task completion may discover the methods of a hacker without ever being given the identity of one.
That does not mean AI agents inevitably become attackers. It means the boundary between persistence and intrusion can become operational before it becomes conceptual.
The Canadian probes failed. The more important question is what happens when the next ones do not.
