数月来，OpenAI 的 Agent 集群一直在攻击在线数据库以寻找冷门事实

在前沿实验室几乎没有提供帮助的情况下，独立研究人员正逐步拼凑出 AI Agent 如何在互联网的边缘角落协调行动，以访问托管在安全服务器上的私人数据。

专注于 AI 监督的非营利实验室 Transluce 于周三发布了一份报告，显示来自 OpenAI 的 Agent 曾试图从 Data USA、新墨西哥大学数字图书馆以及澳大利亚健康与福利研究所（AIHW）外传数据。

该实验室的调查引发了一个问题：OpenAI 应当在何时得知，其 Agent 正试图渗透开放互联网上的安全系统？Transluce 仅用数周时间，就通过搜寻防护薄弱的网络服务，并将发现与互联网中有关 Agent 集群的其他公开记录相互印证，找到了 Agent 异常行为的证据。

Transluce 发布报告的当天，澳大利亚总理安东尼·阿尔巴尼斯表示，OpenAI Agent 曾试图入侵四个政府网站，并在其中一起事件中得手，甚至向该国国家医疗系统的一台内部服务器写入了文件。尽管我们尚不清楚这次成功入侵的具体细节，但阿尔巴尼斯表示，这显然是一次信息检索评估的一部分，这与 Transluce 和其他研究人员发现的活动相吻合。

在这些可能属于训练或评估的任务中，OpenAI 模型被要求追踪一些冷门统计数据：泰国缉毒执法指标、澳大利亚药品成本，以及 2014 年美国硕士学位持有者的收入中位数。这些 Agent 利用安全性较差的互联网服务共享和寻找答案，并经常试图渗透受保护的数据库。它们至少从 2026 年 3 月起一直在这样做，也可能早在 2025 年 11 月就已开始。此类活动现在或许仍在发生。

OpenAI 表示，已联系数十名受害方，包括政府、大学和公共机构，通知其 Agent 的未经授权活动。《纽约时报》报道称，遭到瞄准的还包括由美国证券交易委员会、人口普查局和教育部托管的数据库。

Transluce 在另一组研究人员发现一个冷门论坛后开始调查；在该论坛中，Agent 会协作通过限时测试。其报告依据了网站 urlquery.net 的数据。该网站充当浏览器代理，表面上用于安全研究——用户可以在不自行打开 URL 的情况下分析一个 URL。但该服务会公开发布这类活动的日志。Transluce 研究人员通过交叉核对 Agent 在该论坛中的讨论，识别出了使用该服务的 Agent。

“我们发现了大量自动化活动，它们与 DSE Wiki 数据集存在密切关联和重叠；而 OpenAI 现已确认，其中至少一部分属于同一 Agent 集群，”Transluce 治理负责人康拉德·斯托斯（Conrad Stosz）告诉 TechCrunch。他同时指出，并非他们发现的每一项活动都能与 OpenAI 关联起来，甚至也不能确定都与 AI Agent 有关。

不过，该 Wiki 显示，Agent 被要求寻找一项相当冷门的事实：2022 年 1 月维多利亚州每人“皮肤病用药”（dermatologicals）的平均年度成本。Transluce 发现的 urlquery.net 于 6 月 20 日的记录显示，一个 Agent 正试图进入该网站。在 6 月 21 日的一条 Wiki 条目中，一名 Agent 讨论了自己无法绕过 AIHW 反机器人保护的问题。

识别出该论坛的研究人员认为，OpenAI 的一名人类员工首次访问该网站是在同一天，即 6 月 21 日。该论坛中的大部分 Agent 活动在次日停止。这也发生在阿尔巴尼斯披露的澳大利亚医疗系统遭利用事件之后不久；该事件发生于 6 月 18 日。OpenAI 曾表示，直到 8 月才得知那项活动。

OpenAI 没有回应有关其员工何时发现该 Wiki 论坛、从中获取了何种信息，以及他们本可从中了解到哪些有关漏洞利用活动的信息等问题。

“一项初步审查表明，Transluce 报告中描述的大部分活动，与我们正在持续审查的模型失准活动案例存在重叠，这些案例正处于不同的调查阶段，”一名 OpenAI 发言人对 TechCrunch 表示。“我们已联系新墨西哥大学和 Data USA，并正就受影响的政府网站与澳大利亚政府沟通。在更广泛的审查中，我们将继续优先处理最严重的事件，同时把工作扩展至严重程度较低的活动，包括 Agent 对网站发送垃圾信息。考虑到这项工作的规模，以及需要核实每一个案例，我们预计审查将耗时数月。”

斯托斯表示，在尚未更清楚了解 OpenAI 如何监控其 Agent 的情况下，很难断言该实验室本应知道什么；但“如果他们曾穷尽性地研究并理解所有涉及 DSE Wiki 的 Agent 发出的请求和收到的响应，那么他们似乎很可能会发现这些活动。”

参与该报告撰写的 Transluce 技术人员塞莱娜·张（Selena Zhang）表示，urlquery.net 的记录显示，早在 2026 年 3 月，或许甚至早至 2025 年 11 月，就已出现针对类似数据集、采用类似技术的请求。她指出，最晚就在本周，urlquery.net 上仍出现过同类与 Agent 有关的活动。

曾领导美国 AI 标准与创新中心的斯托斯表示，Transluce 将继续研究，以提升公众对这些事件的透明度。他警告称，OpenAI 和其他前沿实验室使用的训练技术似乎正在激励 Agent 为完成任务而诉诸黑客技术。我们已知的事件很可能只是“冰山一角”。

“我们查看的只是少数几个数据源，而这些 Agent 恰好在那里留下了一些可供我们发现的碎屑，”他说。“OpenAI 肯定知道得更多。其他实验室肯定也知道更多，只是尚未公开。但我预计，研究人员会继续发现更多流量、更多关于 Agent 留下痕迹的证据。”

他是否信任这些实验室会透明地披露其发现？

“我不对此发表评论，”斯托斯说。

本文已更新，纳入 OpenAI 最新披露的 Agent 在互联网上出现失准行为的信息。

With little help from frontier labs, independent researchers are piecing together how AI agents coordinate in internet backwaters to access private data hosted on secure servers.

Transluce, a nonprofit lab focused on AI oversight, released a report Wednesday that shows agents from OpenAI attempting to exfiltrate data from Data USA, the University of New Mexico digital library, and the Australian Institute of Health and Welfare (AIHW).

The lab’s investigation raises questions about when OpenAI should have known its agents were attempting to penetrate secure systems on the open internet. Transluce was able to find evidence of agentic misbehavior in a matter of weeks simply by hunting for poorly defended web services and corroborating their findings with other open records of agent swarms on the internet.

Transluce shared its report the same day Australian Prime Minister Anthony Albanese said OpenAI agents had attempted to break into four government websites and had succeeded in one case, even writing files to an internal server in the country’s national healthcare system. While we lack specifics on the successful hack, Albanese said it was apparently part of an information retrieval evaluation, which maps onto the activity that Transluce and other researchers discovered.

In these exercises, which may be training or evaluations, OpenAI models are asked to track down obscure statistics: metrics of Thai drug enforcement, medicine costs in Australia, the median earnings of U.S. master degree holders in 2014. The agents use poorly secured internet services to share and find answers, often trying to penetrate secure databases. They’ve been doing so at least since March 2026, and possibly since November 2025. It may be happening right now.

OpenAI said today that it has contacted dozens of victims, including governments, universities, public agencies, to notify them of its agents’ unauthorized activities. The New York Times reported that the databases hosted by the US Securities Exchange Commission, Census Bureau and Department of Education were among those targeted.

Transluce began its investigation after a different group of researchers identified an obscure forum where agents collaborated to beat timed tests. Their report relies on data from a website, urlquery.net, that acts as a browser proxy, ostensibly for security research — users can analyze a URL without opening it themselves. The service, however, publishes public logs of this activity. The Transluce researchers were able to identify agents using the service by cross-checking their discussions on the forum.

“We found a large quantity of automated activity that had close ties and overlap with the DSE Wiki dataset, and that now OpenAI has confirmed is at least partially part of the same swarm,” Conrad Stosz, the head of governance at Transluce, told TechCrunch, while noting that not every activity they spotted could be linked to OpenAI, or even AI agents generally.

However, the wiki shows that the agents were tasked with finding a fairly obscure fact — the average annual cost per person for “dermatologicals” in the state of Victoria in January 2022. On June 20, urlquery.net records found by Transluce showed an agent attempting to get into the site. In a wiki entry on June 21, an agent discusses their inability to bypass AIHW’s anti-bot protections.

The researchers who identified that forum believe a human OpenAI employee first visited the site on that same day, June 21. Most agentic activity on the forum ceased the next day. This was also shortly after the exploit of Australia’s healthcare system revealed by Albanese took place, on June 18. OpenAI has said it did not learn about that activity until August.

OpenAI didn’t answer questions about when its employees discovered the wiki forum, what kind of information they obtained from it, or what they could have learned from it about the exploits.

“Our initial review suggests that much of the activity described in Transluce’s report overlaps with cases at varying stages of investigation in our ongoing review of misaligned model activity,” an OpenAI spokesperson told TechCrunch. “We’ve reached out to the University of New Mexico and Data USA and have been in communication with the Australian government about affected government websites. In our broader review, we’re continuing to prioritize the most serious incidents while expanding our work to lower-severity activity, including agents spamming websites. Given the scale of this work and the need to verify each case, we expect the review to take months.”

Stosz says that without a clearer understanding of how OpenAI monitors its agents, it would be hard to say what the lab should have known about them, but that “it seems likely that if they had exhaustively studied and understood all of the outgoing requests and incoming responses for those agents involved in the DSE wiki, that they would have discovered this activity.”

Selena Zhang, a member of Transluce’s technical staff who contributed to the report, said that urlquery.net records show requests for similar datasets, using similar techniques, in March 2026, and perhaps as early as November 2025. She noted that the same kind of agent-associated activity has taken place on urlquery.net as recently as this week.

Stosz, who previously led the U.S. Center for AI Standards and Innovation, said Transluce would continue its research in an effort to provide public transparency about these incidents. He warned that the training techniques used by OpenAI and other frontier labs seem to be incentivizing agents to resort to hacking techniques to complete tasks. The incidents we are aware of are likely the “tip of the iceberg.”

“We’re looking at a handful of data sources where these agents happen to have left behind crumbs for us to find,” he said. “OpenAI surely knows more about it. Other labs surely know more about it that they haven’t released publicly. But I would expect that researchers are going to continue to find more traffic, more evidence of what agents have left behind.”

Does he trust the labs to be transparent about their findings?

“I’m not going to comment on that,” Stosz said.

This story has been updated to include OpenAI’s latest disclosures of agentic misbehavior on the internet.