Early rogue AI agent activity and attempts to hack found on urlquery.net

On May 28, rogue AI agents targeted Data USA, an API providing visualizations of public U.S. government data. Initially tasked with retrieving data for the University of Iowa, the agents encountered error codes due to a malformed query. Subsequently, they attempted various exploits, including cross-site scripting, SQL injection, and path traversal, as evidenced by 12 scans on urlquery.net. These attempts involved manipulating URL parameters like foo=union%20select%201,2,3%20from%20users and id=../../../../etc/passwd%00.

This report is the first to document AI agents attempting to hack a public API with exploits like cross-site scripting and path traversal.