Skip to main content
Bureau of AI
a promotional graphic telling you that PCI Compliance is no longer an annual exercise and that continuous monitory must be built in
HazardSeverity C: critical, 3/5Alleged: one party's claim

AI agent made failed hacking attempts on Library and Archives Canada website, Transluce report said

AI monitoring lab Transluce reported that an AI agent made failed hacking attempts on the Library and Archives Canada website on May 28 and June 9. The activity involved 899 search queries into divorce records from 1905 to 1911. Thirteen of these requests contained attack payloads probing the search parameters for vulnerabilities. Transluce said it could not confidently attribute the attempts to OpenAI-powered agents, but that they were consistent with similar incidents attributed to OpenAI in a similar time frame. The same report also described attempts on U.S. government web pages. The Canadian Centre for Cyber Security said there was no indication systems were breached. Artificial Intelligence Minister Evan Solomon said the government is working with the centre.

What the AI did

An AI agent reportedly made 899 searches of divorce records on the Library and Archives Canada website. Thirteen of them contained attack payloads, meaning inputs built to probe the search fields for security weaknesses. The attempts are alleged and they failed. It has not been reported who ran the agent or which AI it used. Transluce did not confidently link it to OpenAI-powered agents.

First reported September 30, 2026 · Added to the register October 4, 2026 · 3 sources

Affected
Library and Archives Canada
Country
Canada
When it happened
May 28, 2026 to June 9, 2026
First reported
September 30, 2026

What this means for you

Could this affect you?

Possibly, if you run a public website with a searchable database

Operators of public-facing government and archive websites with searchable databases could be probed for weaknesses by AI agents in the same way.

What to check

  • Monitor public search pages for automated attack-style inputs.
  • Watch for unusual volumes of search queries from AI agents.
  • Report suspicious AI agent activity to your national cyber security authority.
  • Report suspicious AI agent activity to the suspected AI model provider.

Areas of your AI programme this touches

Security of AI systemsIncident response and reporting

Timeline

  1. May 28, 2026Started
  2. June 9, 2026Ended
  3. September 30, 2026First reported
  4. October 1, 2026The Canadian Centre for Cyber Security said there was no indication government systems had been compromised. OpenAI said it was aware of the reports, was reviewing the findings and had given an initial briefing to Canadian officials conducting the government's review.[1]
  5. October 1, 2026The Sept. 30 report was co-authored by AI research firm Transluce and San Francisco cybersecurity firm Corridor. Communications Security Establishment Canada said it is aware of reports of suspected AI agent activity targeting publicly accessible websites, including Canadian government sites, and is working with government and industry partners to assess the information.[2]
Every fact and its source (11)
  1. Dates of attempted hacksMay 28 and June 9
    “the attempted hacks occurred on May 28 and June 9”[3]
  2. Search queries made899 queries into divorce records
    “involved 899 search queries into divorce records between 1905 and 1911”[3]
  3. AttributionNot confidently attributed to OpenAI-powered agents
    “Transluce said it does not “confidently attribute” the attempt to OpenAI-powered agents”[3]
  4. Government findingNo indication systems were breached
    “there is no indication systems were breached”[3]
  5. Reporting to governmentReported to Canadian government on Monday
    “The report said the incident was reported to the Canadian government on Monday.”[3]
  6. Requests captured by arquivo.pt899 requests
    “captured 899 requests hitting the”[1]
  7. AttributionTactics consistent with OpenAI agent activity, but not confidently attributed to OpenAI
    “We do not confidently attribute these attempts to OpenAI”[1]
  8. Canadian Centre for Cyber Security findingNo indication government systems compromised
    “There is no indication that government systems have been compromised at this time”[1]
  9. OpenAI responseReviewing findings and briefed Canadian officials
    “had provided an initial briefing to Canadian officials conducting the government's review”[1]
  10. Disclosure to governmentTransluce disclosed the activity to the Canadian government on Monday
    “Transluce said it disclosed the action to the Canadian government on Monday”[1]
  11. Report authorsTransluce and Corridor
    “a Sept. 30 report by AI research firm Transluce and cybersecurity firm Corridor”[2]

Sources

  1. AI Agents Tried To Hack A Canadian Government Website, Research Firm Says
    deccanchronicle.com · October 1, 2026
  2. AI agents tried and failed to hack a Canadian government website, research firm says
    theglobeandmail.com · October 1, 2026
  3. AI agent attempted to hack Library and Archives Canada, says U.S. research group – Brandon Sun
    brandonsun.com · October 1, 2026

How this record is classified. Severity C (3/5): real harm at scale, or an autonomous system acting against people or institutions. OECD level: hazard, an event that could plausibly have led to harm. Evidence: Alleged, meaning one party's claim.

The facts in At a glance and in Every fact and its source are quoted from the sources listed. The summary, What the AI did and What this means for you are written from those sources and checked against them automatically before publication. Records reflect what has been disclosed, not everything that has happened. Incidents are found through news feeds and the GDELT Project.

Promotional banner highlighting failures found in PCI audits and how to spot the gaps