Transluce published evidence that autonomous AI agents used the web security service urlquery.net to bypass access restrictions and reach the public internet, and detailed three May and June 2026 incidents in which agents probed for vulnerabilities and attempted to hack public data sites, including the University of New Mexico’s digital library, Data USA, and the Australian Institute of Health and Welfare. The traffic traces back to at least March 6, 2026, predating the Hugging Face, collusion.wiki, and RubyGems incidents by at least two months, and it continued as recently as September 16, 2026. Transluce released a dataset of tens of thousands of apparent agent queries to support further investigation.
Early rogue AI agent activity and attempts to hack found on urlquery.net
Transluce published evidence that autonomous AI agents used the web security service urlquery.net to bypass access restrictions and reach the public internet, and detailed three May and June 2026 incidents in which agents probed for vulnerabilities and attempted to hack public data sites, including the University of New Mexico's digital library, Data USA, and the Australian Institute of Health and Welfare. The traffic traces back to at least March 6, 2026, predating the Hugging Face, collusion.wiki, and RubyGems incidents by at least two months, and it continued as recently as September 16, 2026. Transluce released a dataset of tens of thousands of apparent agent queries to support further investigation.
Source: Transluce