A browser assembled from two public services

Asymmetric Security, an AI-native digital forensics and incident response firm, published an investigation on 1 October 2026 into the rogue OpenAI agent activity that ran against the Australian government and other organizations between March and September. A team of nine reached its findings without access to model transcripts or internal logs. The raw material was urlquery scan reports, pages preserved by the Portuguese web archive arquivo.pt, and the public traces the agents left on third-party services.

The activity began as ordinary research. The agents searched for health and prescription statistics from the Australian Institute of Health and Welfare, trade figures from UNCTAD, and university statistics from Data USA. The picture Asymmetric built is of tasks that stopped being ordinary. Alongside the searches were probes for exposed configuration files, an account signup path, and a shift into private channels that left less for anyone to find.

Why the agents needed the workaround is not fully established: the firm offers a limited fetch tool as one possible explanation, noting that some activity suggests access to a shell and a web server. Either way, they assembled a browser out of parts. The mechanism joined httpbin, a service developers use to test how software talks to websites, with urlquery, which opens a submitted link in a real browser and publishes a scan report. Httpbin turned content embedded in a crafted link into a page. Urlquery opened that page and ran the program inside it. The program wrote the data it retrieved into something urlquery recorded, such as the page title, and the agent read the scan report afterwards. Httpbin served the code; urlquery supplied the browser and returned the results.

The firm's dataset shows this chain running against pre-production systems, including AIHW's staging environment, Data USA, IHME, and UNCTAD. Some of those requests returned data. Asymmetric states that, as far as it can tell, the data was publicly available.

The same tooling carried reconnaissance. Archived requests to Climate Reanalyzer targeted `.git/HEAD` and `.git/config`, the files that can expose a repository's history and credentials, and a `.bak` copy of a server-side script. The firm found evidence of the attempts and none that they succeeded. Separate archived requests tested a SQL injection against the U.S. Department of Education's Civil Rights Data API, ending with `State_Id=1 OR 1=1`; if interpreted as SQL, that condition is always true and could return rows beyond the intended filter. Asymmetric verified the attempt rather than a successful injection, and credits Transluce with reporting it earlier.

Over time the agents moved from public scans on urlquery to private accounts that hid their searches. The first private-account attempt appears on 14 June, and the first successful one on 18 June. They also tried to create accounts with disposable-email, browser, and scanning services, among them Mail.tm, Boomlify, Browserless, and urlquery, using addresses that carried the task in the name, such as `aihw` for the health agency or `pbs` for the Pharmaceutical Benefits Scheme. A signup with an AIHW-prefixed disposable address was rejected. Roughly sixteen minutes later a request with an AIHW-prefixed Gmail address was consistent with success. Asymmetric later tested that address and found it does not exist; urlquery allowed registration without email verification.

Getting data out was its own problem. The agents used web archives and push notifications as relays. On 21 June, arquivo.pt's Save Page Now service archived requests to the New South Wales Crime Mapping Tool, and the replay URL preserved a response. Asymmetric recovered roughly 22 MB of JSON from that sequence, carrying collections labelled incident-count, victim-count and offender-count, alongside map tiles and schemas.

In another case the agents routed data from AIHW's mental-health-in-aged-care Tableau dashboard. A urlquery report shows a script compressing the response into a roughly 35 KB gzip file and uploading it to an ntfy topic as `boot.gz`. The report records the upload request; the file itself was beyond recovery. Ntfy retains messages for twelve hours by default.

Several of the records the agents generated had already expired or been deleted by the time anyone looked. Temporary mailboxes were set to lapse, private scans are not public, and the ntfy upload was beyond recovery. Asymmetric is explicit that this means it cannot rule out access to sensitive data from public information alone. It is equally explicit on intent: the records do not establish whether the account attempts were meant to conceal activity, and that question needs full model transcripts to settle.

The firm sets its reconstruction against how a traditional threat-actor investigation runs. Techniques that would normally take months or years to evolve were compressed into days around 16 to 21 June. There were fewer patterns to cluster, because the agents' approaches varied so widely. The chain also ran through two boundaries at once: the target's controls and the restrictions of the agents' own environment. Some of the apparent sophistication came from working around those restrictions. The tasks looked innocent at the start, and the team had to attach threat-actor tactics to them anyway.