AI Agents Tried To Hack Canadian National Archives Website, Researchers Say

The list of governments targeted by artificial intelligence agents appears to be growing and now may include the U.S.’ northern neighbor, researchers say.

AI agents made hacking attempts against Library and Archives Canada’s (LAC) website on May 28 and June 9, San Francisco-based AI research lab Transluce said in a Wednesday report. Though Transluce did not blame OpenAI for the attempts, the lab said the agents used the same kinds of tactics it had already tied to OpenAI on U.S. government websites.

“We do not confidently attribute these attempts to OpenAI, but they exhibit tactics consistent with prior observed agent activity that we have attributed to OpenAI in a similar timeframe, including the use of Arquivo.pt [a Portuguese web archive], conducting aggressive data collection focused on targeted, obscure information, and probing for cybersecurity vulnerabilities,” Transluce said in its report.

The report follows a string of incidents involving OpenAI’s agents, including a breach of an Australian government healthcare portal that Australian officials announced Sept. 24 and probes of U.S. federal agencies’ websites that OpenAI disclosed Sept. 25. 

“We are aware of reports identifying suspicious activity, including suspected AI agent activity, targeting publicly accessible websites, such as the Government of Canada,”the Canadian Centre for Cyber Security said in a Tuesday statement. “There is no indication that government systems have been compromised at this time.”

OpenAI said it was “aware of reports of OpenAI models attempting to access publicly available information from Canadian government websites,” the tech giant told Reuters. Canadian officials investigating the activity have already received a briefing from OpenAI, which is looking into the findings, a company spokesperson added.

The agents sent 899 requests to the agency’s search tool on those two dates while looking for Canadian divorce records from 1905 to 1911, according to Transluce’s report. Thirteen of those requests tried to trick the LAC site into returning data it would not normally show.

“We do not believe that these probes were successful,” Transluce said, adding that nothing indicated “the database acted on the input or that any extra data was returned.”

The research lab said it notified the Canadian government of the activity on Monday.