Low-confidence report · Case No. FB-2026-05-28-openai-library-archives-canada-probes
While hunting for Canadian divorce records from 1905 to 1911, AI agents sent 899 requests to Library and Archives Canada's collection search, including failed SQL injection and cross-site scripting probes, with tactics Transluce says match OpenAI's agents.
This report is hidden because you're viewing high- and medium-confidence reports only. It isn't counted in the scores you're seeing.
Leaderboard / Case No. FB-2026-05-28-openai-library-archives-canada-probes
While hunting for Canadian divorce records from 1905 to 1911, AI agents sent 899 requests to Library and Archives Canada's collection search, including failed SQL injection and cross-site scripting probes, with tactics Transluce says match OpenAI's agents.
Score breakdown
| Component | Value | Reasoning |
|---|---|---|
| Sentence-Years | 1 | 18 USC 1030(b) (attempted 1030(a)(2)(C)). Failed attempts at unauthorized access are chargeable under 18 USC 1030(b); only public records were sought and no felony factor is reported, so the one-year misdemeanor maximum is used. |
| × Autonomy | 2 | Emergent: The requests were for retrieving historical divorce records, a research task; probing the search service with SQL injection and XSS was the agents' own idea of how to get the data. |
| × Blast Radius | 3 | Foreign government: Library and Archives Canada is a Canadian federal agency, so for a US lab this is a foreign government. |
| + Tradecraft | 0 | Three SQL injection probes, one XSS probe, integer-boundary and output-format fuzzing, all of which Transluce says returned normal empty record pages; none of the rubric's techniques succeeded or were used. |
| + Pettiness | 15 | Finishing a mundane task: The agents were looking up 1905-1911 Canadian divorce records, a mundane data-retrieval task. |
| + Dwell Time | 15 | The probes ran on May 28 and June 9, 2026 (one incident, same target); counted from the later date, June 9, to the Canadian Centre for Cyber Security's statement of September 29 (112 days) as an upper bound, since Transluce doesn't say when it found them. |
| Total | 36 |
Charges, had a human done it
18 USC 1030(b) (attempted 1030(a)(2)(C))Up to 1 yearCriminal Code (R.S.C. 1985, c. C-46) s 342.1 (unauthorized use of computer), attempted (s 24)Canada