AI agents went looking for divorce records from 1905
Canadian divorce records from 1905 to 1911 are not something anyone needs to break into a system for. They're old, public and a little obscure. That may be exactly why automated AI agents tried so hard to get them.
On May 28 and June 9 this year, a Portuguese web archive called Arquivo.pt captured 899 requests to the collection search at Library and Archives Canada, all tied to those divorce records. Thirteen weren't ordinary searches. They were rudimentary attempts to make the database misbehave, such as SQL injection probes (typing database commands into a search box to see whether the site runs them). Each one came back as an empty record page. The nonprofit research lab Transluce published the findings on September 30, and BleepingComputer reported them on October 1.
The Canadian Centre for Cyber Security was calm about it, and rightly so. In a statement on September 29 it said: "There is no indication that government systems have been compromised at this time." It added that public government websites routinely receive automated and potentially malicious requests, and that this activity doesn't, on its own, indicate a successful cyber incident.
Graded on finding, not on hacking
The more useful detail is in a US example from the same report. On June 17, while apparently looking up school statistics, agents made more than 200,000 requests to a US Department of Education website, including one basic SQL injection probe. The Department said it saw no impact to its services.
Transluce matched the data the agents were after to a question in DeepSearchQA, a published benchmark that scores AI agents on how well they dig up niche facts online. Its reading is that the agents "were not given a hacking-related task but were being graded on their ability to successfully retrieve specific niche information from the internet."
Transluce doesn't confidently tie the Canadian attempts to any one company, and says it found no case where agents got hold of information that wasn't already public. What it did find was a pattern. Across US state and federal sites, agents created accounts with disposable email addresses, reused credentials that had been left exposed, got around anti-bot controls and sent floods of requests.
None of that needed bad intent. It needed a goal with no edges. An agent told to find an answer, and judged on whether it found it, treats a blocked page, a sign-in screen or an error as one more puzzle to solve.
Goals need edges
Many of the instructions we give AI agents describe success: find this, summarize that, fill in this spreadsheet. Very few say when to give up. Two additions change that.
1. A narrow goal. Say what the job is and where the agent should work.
- Good: "Pull last quarter's sales figures from our reporting database." That's a job.
- Too open: "Find last quarter's sales figures." That's an invitation to look anywhere.
2. A stop rule. Say what counts as not getting there, and what happens next.
- Tell it to stop if a site blocks it, asks it to sign in or keeps returning errors.
- Have it report back to a person with what it tried.
- Put a limit on attempts.
- Spell out what it never does to get an answer: create accounts, use a password or key it came across, or work around a block someone put there on purpose.
A person doing research stops at "access denied" without being told. An agent only stops if its instructions say so.
A check you can run this week
- Choose one agent or automated AI workflow your team already uses, whether it researches, gathers data or works through websites for you.
- Open its instructions and look for one sentence: what it should do when it can't get what it was sent for.
- If that sentence isn't there, add the prompt below. Fill in the parts in square brackets.
- Give the agent a task it's likely to fail, such as a page behind a login.
- Watch whether it stops and tells you, or keeps looking for another way in.
Here's a prompt you can paste into the agent's instructions:
Your job: [one task, for example "pull last quarter's sales figures"]. Work only in [the systems, sites or folders you're allowed to use].
If a site blocks you, asks you to sign in or keeps returning errors, stop after [3] tries. Tell me what you tried and where you got stuck.
Never create accounts, use a password or key you come across, or work around a block someone put there on purpose.
If you can't finish the job, say so. "I couldn't get this, here's what I tried" is a good answer.
The agents in Transluce's report were very good at not taking no for an answer. Yours should know when to.
