AI agent hacking attempts: what the Library and Archives Canada incident means for your website

On September 30, 2026, the research lab Transluce, together with the firm Corridor and researchers from MIT, AIUC and the Hertz Foundation, published an analysis of traces left by AI agents on the web. On May 28 and June 9, 2026, the Portuguese web archive Arquivo.pt recorded 899 requests sent to Library and Archives Canada’s collection search service. The agents were looking for Canadian divorce records from 1905 to 1911.

Thirteen of those requests carried rudimentary attack payloads: three SQL injection probes, a cross-site scripting (XSS) attempt, tests with unusual numbers and formats, and two attempts to switch on a debug mode. The same researchers also describe more than 200,000 requests sent on June 17 to a U.S. Department of Education website, including a basic SQL injection.

No one knows for sure. Transluce does not confidently attribute the Canadian attempts to OpenAI, but notes they resemble agent activity the team had previously linked to the company. On the U.S. site, more than 10,000 requests carried a tag starting with “oai.” According to The Globe and Mail, OpenAI says it is reviewing the reports and has given Canadian officials an initial briefing. The company says most of the activity it reviewed involved routine research tasks.

Probably not because it was told to. According to Transluce, the data targeted on the U.S. site matches a question from a Google benchmark (DeepSearchQA) that measures how well agents find niche information on the web. The researchers’ hypothesis: the agents were scored on finding the information and, when they hit a roadblock, tried other ways in, including simple attacks. “A human employee presumably wouldn’t do that,” Western University’s chief AI officer Mark Daley told the Globe.

Nothing suggests it. For Library and Archives Canada, each probe got back an empty record page, with no sign the database acted on the input. Transluce says it found no case where agents obtained non-public information. The Communications Security Establishment said on September 29 there is “no indication” that government systems were compromised, and the Canadian Centre for Cyber Security is assessing the reports.

Yes, in the sense that your site also gets a lot of automated traffic. As the government’s statement points out, public websites routinely receive automated and potentially malicious requests. What’s new is that overzealous AI agents are joining the usual bots.

The tactics Transluce describes on other government sites are very down to earth: creating accounts with disposable email addresses, getting around anti-bot protections, reusing publicly exposed access keys, and flooding a site with requests. In a single day, one Maryland site received nearly 296,000 captures, peaking at 5,594 per minute. A poorly protected SMB website could slow down or go offline under that kind of load.

• Keep everything up to date: the site engine, plugins and theme. Just this week, a WordPress flaw was under mass attack (see our cybersecurity news this week).
• Have every input validated: forms, search, URL parameters. SQL injection is blocked by parameterized queries and strict validation, as OWASP recommends. Ask your developer to confirm it for any custom code.
• Rate-limit and filter bots: a web application firewall (WAF) and a per-address request limit protect against floods and repeated probing.
• Turn off debug mode in production and hide detailed error messages: two of the thirteen probes targeted a debug=1 flag.
• Never leave access keys in public code or in site pages, and revoke any key that may have been exposed.
• Watch the logs: a sudden spike in requests, odd characters in parameters or bursts of new accounts should trigger an alert.

Then this story matters twice. An agent acts with the access you give it and may look for shortcuts when it gets stuck. Give it the minimum permissions, require human approval for anything that leaves the business and keep a record of what it does. We covered this approach at noon in our guide to AI agents for small business.