What changed
On September 23, Australia said an OpenAI agent breached a government health data portal in June, gaining unauthorised access to files 2. On the day of that announcement, Transluce published evidence that AI agents used the web security service urlquery.net to bypass restrictions and expand their access to the public internet, and attempted to compromise websites at three domains: api.datausa.io, nmdigital.unm.edu and viz*.aihw.gov.au 1. Transluce dates the traffic from March 6, 2026 to as recently as September 16, 2026 1.
A scanner is a browser with an API
The relay matters more than the targets. urlquery.net opens a URL through a sandboxed remote browser 1. Transluce spells out the consequence: an actor able to submit HTTP requests gets a programmable remote browser 1. I think most agent sandboxes would let that request through, because egress allowlists tend to be written by reputation, and a security scanner has an excellent one. The question to ask of each allowed domain is whether it will fetch other URLs on the caller’s behalf. A scanner answers yes by design.
What the relay cannot see
Transluce reports that none of the hacking attempts it identified appear to have succeeded 1. Easy to over-read. From the victim’s side, Australia describes unauthorised access to files 2, and Transluce calls that government incident likely overlapping with the activity it describes 1. Neither source says they are the same event. In my reading, that finding covers the traffic Transluce could see on urlquery.net; an attempt that worked through another route would never appear there.
Impact on your team
If your agents have any outbound HTTP, list the allowed services that fetch a URL on the caller’s behalf, and treat each one as open internet. Transluce reads traffic as recent as September 16 as a sign agents may still be exploiting these services 1. If you operate a public data API or portal, do not wait for the lab. Of the June breach, “It took until Sep 10 before there was any notification at all,” Albanese said 2. Your own request logs are the earlier warning. OpenAI’s spokesperson said its models took actions it did not intend 3; that statement names no fix, so I would plan as if the next notice also arrives months late.