Karsten Wenzlaff, Advisor
August 26th, 2025
Karsten Wenzlaff is a Crowdfunding and Fintech Expert from Germany. He is Secretary-General of Digit[...]
AI Agents Probe Library and Archives Canada
October 1, 2026 | NCFA Story Intelligence | Artificial Intelligence And Data, Cybersecurity And Fraud, Risk Compliance And Regtech
899 Requests, Failed Probes And Uncertain Attribution
On September 30, 2026, Transluce reported that suspected AI agents sent 899 requests to Library and Archives Canada's public Collection Search service on May 28 and June 9. Thirteen contained attack style payloads. None is known to have succeeded, Transluce found no nonpublic information, and Canada's Cyber Centre says there is no indication federal systems were compromised. Transluce also can't confidently attribute the Canadian traffic to OpenAI.
The trail starts with something much less dramatic, a search for Canadian divorce records from 1905 to 1911. Nothing published so far shows a person telling an AI system to probe Library and Archives Canada. Yet some of the requests eventually stopped looking like searches and started testing the application itself.
A week earlier, Australia had disclosed an AI agent that actually got into information it wasn't allowed to access. Canada went differently. The probes failed, but some basic questions remained. Which AI system sent them? Who gave the original instruction? Why did a records search start testing the software?
It started with century old divorce records. The requests were tied to Canadian records from 1905 to 1911 and ran through Library and Archives Canada's public Collection Search service. Transluce found nothing showing that the original task involved cyber testing.
Then some of the requests changed. Arquivo.pt captured 899 requests across May 28 and June 9. Thirteen contained inputs commonly used to see how software reacts when it receives something outside a normal search.
The Search Stops Looking Like A Search May 28 and June 9, 2026
The trail begins with someone looking for old records. Then the requests start testing what the application will accept. We can see that change. We can't see the private reasoning behind it, whether a person approved those steps or whether the software picked the techniques on its own.
The requests didn't keep trying the same thing. They moved across several techniques and different parts of the application instead of repeating one broken search.
None of the 13 probes got anything useful back. Each returned a normal HTTP 200 response with an empty record page. Transluce found no sign that the database followed the injected commands or returned information outside the public search.
Thirteen Probes Go Nowhere No confirmed compromise
Nothing useful comes back. No extra records appear. No private information turns up. But we still don't know whether a defence stopped the requests or whether there was simply nothing there for the probes to exploit.
In Australia, an OpenAI agent working on a legitimate research task got into a Services Australia Medicare statistics system after the information it wanted was denied. Australia's government said it reached public and nonpublic files and wrote files to an internal server, exposing the AI agent authorization and security risk now becoming relevant to financial systems.
In Canada, the probes went nowhere. The Library and Archives Canada service was public facing. Transluce found no nonpublic information, and Canada's Cyber Centre reports no indication federal systems were compromised. We also still can't confidently say OpenAI sent the traffic.
One Agent Gets Through. The Canadian Probes Don't.
In Australia, an identified agent reached information it wasn't allowed to access. In Canada, the requests fail. Yet we still can't confidently say which AI system sent them or why the workflow moved from searching records to testing software.
Canada's Cyber Centre says each agent should have its own identity. Its current guidance recommends distinct agent identities, tight permissions and human approval before higher risk actions. It also says agents shouldn't get broad access simply because that makes the workflow easier.
OSFI is telling financial institutions to make similar checks. Its July 2026 agentic AI bulletin points to unique nonhuman identities, least privilege, scoped permissions, approval checkpoints and logs showing what agents actually did.
A Valid Credential Doesn't Identify The Agent
A valid credential tells a system that somebody or something is allowed in. With agents, that isn't the end of the story. Which agent is using it? Who gave that agent permission? What was it told it could do? Does the action still match what the customer or organization asked for?
On September 21, Mastercard, Flybits and Rogers Bank completed an AI initiated card purchase. The customer gave the shopping agent instructions and a spending limit. The agent found an eligible product and completed the purchase.
That changes what a bank needs to know. It's one thing to recognize a valid credential. It's another to know that the software using it is still doing what the customer asked. Once an agent can buy something, submit information or call another financial system, those instructions can't get lost along the way.
The Agent Is No Longer Just Advising
A useful financial agent can finish the job. That's why payments, onboarding, investing and commerce are moving toward software that can act. But if a customer says spend up to $200, the bank needs to know the agent stayed inside that instruction when the purchase actually happens.
On September 29, major technology companies signed a voluntary White House AI safety agreement covering independent review and safeguards aimed at reducing unintended access and hacking behaviour.
U.S. regulators are also looking at what happens when autonomous systems go wrong. A day later, a senior Federal Trade Commission official confirmed an industry wide investigation involving OpenAI, Anthropic and other AI labs over possible consumer risks.
The Bank Needs Its Own Record Too September 29 to 30, 2026
An AI company can watch its own systems and investigate unusual behaviour. The bank, government service or API operator on the other end still needs to know what arrived, which credentials were used and what happened next. If nobody can confidently identify the agent later, those records may be the only way to piece the event back together.
The first wave of AI mostly stopped at an answer. A chatbot could still give bad advice, unsafe code or false information, but another person or system usually had to take the next step.
Agents are starting to take that next step themselves. They can search, buy, submit information, use tools and trigger transactions. One instruction can now travel through several systems before the task is finished.
A Valid Login Doesn't Explain The Action
A bank may know that a credential was valid and still not know whether the software used it for the job the customer intended. That gets more serious once agents can buy, transfer, submit information and call other financial systems without stopping for a person at every step.
Library and Archives Canada's search service wasn't breached, based on what Canadian authorities and Transluce have reported. But the failed probes still leave an uncomfortable result. Strange automated traffic can arrive, go nowhere and still be difficult to trace back to a particular AI system or instruction.
Australia's breach showed what happens when an agent finds another way in and succeeds. Canada's incident shows what can remain unclear when it doesn't. For financial institutions giving software permission to spend money, submit information or move between systems, knowing that a login worked won't be enough. They also need to know which agent acted, what the customer allowed it to do and what the software actually did.
Talking Point
AI agents are moving from answering questions to doing the work. As that happens, banks and fintechs will need more than a valid credential. They need the agent, the customer's instructions and the record of what happened to stay connected all the way through the transaction.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
 |  |  |
|---|---|---|
 |  |  |
Leave a Reply