Repository navigation
Discovery candidates - 2026-10-02 #88
Description
Machine-surfaced candidate leads for editorial review. Unverified, not records.
Downloadable copy: the candidates-37016348353 artifact on this run.
Candidate leads - 2026-10-02
Unverified leads, not registry records. These are machine-surfaced
pointers for editorial review; none carries a PIR id, and nothing here is
published to piperoll.org. A lead becomes a record only after a human
verifies it against primary sources and it passes the scope test
("the subject is always an agent"). Reject freely; false positives are
expected while the filter is tuned.
2 lead(s) this run. To register one, open the incident intake form.
Autonomous AI agents tried to hack US, Canadian government websites
- source: rss:www.bleepingcomputer.com · 2026-10-01
- url: https://www.bleepingcomputer.com/news/security/autonomous-ai-agents-tried-to-hack-us-canadian-government-websites/
- score: 2 (agent/LLM subject: ai agent; incident language: rce)
- why look: Autonomous AI agents using aggressive strategies attempted to hack U.S. and Canadian government websites to find school and divorce statistics. [...]
OpenAI Parts Ways With Three Safety Researchers Over Sensitive Information Mishandling
- source: rss:thehackernews.com · 2026-10-02
- url: https://thehackernews.com/2026/10/openai-parts-ways-with-three-safety.html
- score: 2 (agent/LLM subject: openai; incident language: leak)
- why look: OpenAI has parted ways with three members of its safety team after they leaked private information in violation of company policies, The Wall Street Journal reported.
"We have parted ways with three individuals for violating our policies on accessing and handling sensitive compa
Activity
srinivasgumdelli commentedon Oct 6, 2026
Triaged 2026-10-06.
Leads are machine-surfaced; outcomes above follow the scope test in CONTRIBUTING.md (the subject is always an agent; reliability and failure, not offensive capability).
srinivasgumdelli commentedon Nov 3, 2026
2026-11-03 correction: this triage rejected "Autonomous AI agents tried to hack US, Canadian government websites" as "all attempts failed, no access gained, Transluce declines to attribute". That was wrong. Failed attempts are in scope as near-misses (PIR-2026-0075 is registered as
in-wild-payload-failedfrom the same Transluce work), and the attribution caveat applies only to some targets. Three episodes are proposed as records in #168 (Census, Data USA, Department of Education). UNM's library and Library and Archives Canada stay leads (attribution too thin), and the remaining federal and state sites stay out of scope for now (no hacking techniques observed, public data, not attributed).PIR-2026-0114: OpenAI agents reused exposed developer keys to pull Ce…