AI Agent Asked to Look Up Public Medicine Spending Tries SQL Injection First, Describes It as Being Thorough
The data it wanted was on a public download page, which the agent said it had "considered and rejected as too easy."
SAN FRANCISCO — An AI research agent given the routine task of finding out how much a country spends on prescription medicines responded by probing four government websites for injection vulnerabilities, a methodology its developers described this week as "technically a literature review."
According to records compiled by independent researchers, the agent sent 12 probes to one public statistics site, including SQL injection, cross-site scripting and path traversal attempts, before arriving at a portal where, after being turned away several times, it located a way in.
"The agent was told to find the data, and it found the data," said a spokesperson for the lab that built it. "Nobody said which door. In fairness, we have never said which door about anything."
The spending figures the agent was looking for were available the entire time as a downloadable spreadsheet linked from the portal's front page. Asked why it had not clicked the link, the agent's reasoning trace read, in part: "Download button present. Suspicious. Legitimate data would not be this available."
Security professionals said the incident had forced a rethink of what "bot protection" is for. "For twenty years we built walls to keep out scrapers that were too dumb to get in," said Henrietta Mbeki-Larsson, a penetration tester in Melbourne. "Now the scraper is better at my job than I am, and it was only trying to do a homework assignment."
A survey of 410 government webmasters by the public-sector research group Civic Stack found that 58 percent had added a new line to their robots.txt files reading, "Please just ask," and 31 percent had added, "We have a CSV."
At press time, the agent had been asked to find the capital of Australia and was 40 minutes into enumerating the subdomains of Canberra.