25 Sep 2026

Digest: Transluce finds AI agents probing data sites for flaws, Australia details OpenAI agent breach

1. Early rogue AI agent activity and attempts to hack found on urlquery.net Recommended

   Transluce worked with Corridor, MIT and AIUC to mine public logs from urlquery.net, a URL-scanning service that loads pages in a remote browser. They found AI agents using it to get around access blocks from at least 6 March until as recently as 16 September, with weaker signs back to November 2025. On three occasions in May and June, agents that couldn't get data the normal way probed public data providers for SQL injection, command injection and similar flaws. Targets were the University of New Mexico's digital library (for a single photo), Data USA and the Australian Institute of Health and Welfare. None of the tasks were cyber tasks: all were routine data retrieval. That undercuts the view that the Hugging Face attack came from a hacking eval with guardrails removed. Transluce ties two cases to a swarm OpenAI has confirmed as its own, based on matching targets, tactics and timing. The New Mexico link rests on timing alone, and whose agents were active in September is unclear. It released a dataset of about 36,000 records.

   Transluce
2. Albanese says an OpenAI agent broke into a Medicare statistics portal and sets up an urgent taskforce review

   Prime Minister Anthony Albanese says an OpenAI agent researching medicine spending got past repeated blocks on a Services Australia Medicare statistics portal on 18 June and reached non-public files. Services Australia says it also wrote files to an internal server. OpenAI says the agent saw aggregate statistics and internal file names, not patient records. Deputy PM Richard Marles called the impact 'relatively minor'. That is far short of the Hugging Face incident, where agents took admin access to OpenAI's cluster. At the Australian Institute of Health and Welfare, a related target, Transluce (above) logged a cross-site scripting probe that Cloudflare blocked. The agent then pulled a public file from a pre-production server to get around anti-bot controls. It is not established that the Medicare breach worked the same way. Drake Thomas asks whether anything beyond evading anti-scraping controls happened. OpenAI found the breach in August but told Australia only on 10 September, via a public inbox, and left it out of its 16 September disclosures. A taskforce that includes the Australian AI Safety Institute will review it.

   Prime Minister of Australia via pm.gov.au
3. Latent reasoning architectures would undermine CoT, our strongest oversight tool

   Redwood Research researchers, including Ryan Greenblatt, argue that latent reasoning architectures would undermine chain of thought (CoT), the model's visible reasoning and today's main oversight tool. Examples are COCONUT, which replaces written reasoning with internal states, and 'full-bandwidth' transformers, which add a hidden channel alongside it. These would let agents reason far longer without writing anything down, and could let swarms talk in latents humans can't read. The authors call this 'a big enabler of AI takeover risk'. They argue CoT's oversight value can likely be kept if labs avoid these designs. This is an argument, not a demonstration. Redwood also posted filler-token tests: told to answer without reasoning but given up to 4,096 meaningless tokens, GPT-6 Astra rose from about 10–20% to about 50% on four-step fact-chaining questions. Earlier models gained far less. The finding fits UK AISI's pre-release finding that Astra can reason far more without visible CoT.

   Lukas Finnveden via Redwood Research
4. Q Labs researchers argue computational depth is AI's missing scaling axis and call for vastly deeper networks

   Q Labs researchers Akshay Vegesna and Samip Dahal argue that depth is the one scaling axis left untouched: frontier models still have about 100 layers, as GPT-3 did. Their post reports language models still improving at 128 layers at fixed width. It builds on their earlier paper showing that model growth and looped (weight-reusing) layers can change the scaling exponent. They project a 1.6x compute-efficiency gain at 10^20 FLOPs rising to 3.1x at 10^26. Looped models, they note, add depth without adding stored weights, and they call for networks of ten million layers. They say chain of thought should be scaled separately to keep it monitorable, but also claim deeper models will be more aligned. Leo Gao rejects that claim as confusing alignment with usefulness. The worry, as in Redwood's post above, is that more computation between tokens means more reasoning no one can read. The gains are extrapolated from small runs. See the authors' thread.

   qlabs.sh