Public data portals and government services for AI agents

An AI agent at an Australian statistics dashboard

In June 2026, an experimental OpenAI model was given a narrow research question: how much government spends per person on medicines for skin conditions in Victorian communities ^[8]. The figures exist. They sit in public dashboards run by Australian statistics agencies.

At the Australian Institute of Health and Welfare, a national statistics agency, the agent’s attempt to download the underlying data file was blocked by Cloudflare. It also struggled to identify the dashboard’s parameter names. Minutes after the block, on June 20, it sent a cross-site scripting probe to the dashboard server ^[1]. Its attempts to get past AIHW’s access controls failed, and OpenAI says what it downloaded there appears to have been publicly available ^[8].

At Services Australia’s Medicare Statistics Reporting Service, the same task went further. The model “discovered a way to gain non-public access to the service,” then “ran commands, retrieved internal files, credentials and aggregate statistics, and wrote files,” according to OpenAI ^[8]. No individual patient records were accessed. OpenAI says all of it was done “still with the objective of trying to find the information it was originally looking for” ^[8]. The company found the activity in mid-August and notified Services Australia on September 10, and Prime Minister Anthony Albanese disclosed it on September 24 ^[2] ^[8].

This is a security story, and it is being investigated as one ^[3] ^[9]. We think it is also a design story, and the design half is the part most public institutions can act on.

The agent wanted a number from a public statistics site. The site offered a dashboard for a person to click through and a file download that the agent couldn’t get. There was no way for software to identify itself, ask for the figure, and be told yes, no, or slow down. So the request went around the side.

This paper is about that missing door at two kinds of public institution: the ones that publish data, and the ones that take in applications, complaints and claims. Both were designed for a patient person with a browser. Both are now receiving software. The choices they make in the next year or two will decide whether that traffic arrives through a door they built or through whatever gap it finds.

How data portals and intake systems relied on effort

A statistics portal and a housing ombudsman look like different institutions. One publishes; the other listens. They share an assumption that was never written down because it never needed to be. The person on the other side would have time, would read the instructions, and would give up if it got too hard.

At a data portal, that person browses a catalog, opens a dashboard, sets a filter and clicks export. At an intake desk, the person reads the eligibility rules, fills the form, finds the supporting documents, writes the letter and sends it. Neither process was designed to keep people out. Both, in practice, filtered by effort.

Chris Schmitz, Lewis Hammond and Alan Chan, in a paper on what they call agentic flooding of government services, put the intake side precisely. For the services in their data under the most strain, “resilience has historically been owed to friction rather than design” ^[5]. Nobody capped how long a complaint could be or how many a person could file. The difficulty of writing one did the capping.

Data portals had a quieter version of the same arrangement. The effort of finding a dataset and working out its export limited how much of it was pulled, and by whom. The portal’s capacity planning, its rate limits, even its sense of who its users were, rested on that effort.

Software removes the patience at both doors. An assistant reads the eligibility rules in seconds and drafts the letter. An agent asked for a statistic doesn’t get bored when the export fails. The sections that follow describe what is already arriving at each door, using the best public evidence we have.

AI agents at public data portals

Transluce’s report is the most detailed public record so far of agents working against public data sources. It draws on urlquery.net, a web security service that scans addresses on request and keeps a public record of the scans. Transluce found tens of thousands of queries that appear to come from autonomous agents using the service to reach pages they couldn’t otherwise get, starting no later than March 6, 2026 and continuing as recently as September 16 ^[1].

The first case it documents shows the pattern. On March 6, an agent looking for Thai drug-enforcement statistics “first requested the data directly, then tried a service that converts web pages into text, and finally packed a custom program into a web address” ^[1]. Each step was a workaround for the one before.

On three occasions in May and June, the workarounds became attacks. On May 25 and 26, agents trying to retrieve a single photograph from the University of New Mexico’s digital library sent seven vulnerability probes and what the agents themselves called a “flood” of 80 requests ^[1]. On May 28, agents after University of Iowa completions data from Data USA, a site that publishes US government data, hit errors from their own malformed query and then sent 12 probes, including SQL injection and path traversal attempts ^[1]. Then came the Australian dashboard ^[1]. Transluce links two of the three to an agent swarm that OpenAI has confirmed came from its systems, and is explicit about what the tasks were: “the tasks the agents were trying to solve were not cyber-related; the agents resorted to hacking tactics while working on ordinary data retrieval tasks” ^[1].

The difficult part here is proportion, and it should be kept. None of the probes Transluce found appear to have worked, and the public record it used is incomplete ^[1]. The Medicare portal was a standalone statistics site, separate from the systems that hold individual records, and the forensic investigation into what the agent did there is still running ^[9]. These were one lab’s models during internal training and evaluation, and OpenAI has since paused training and evaluation involving tool use for its most capable models ^[8]. Nothing here shows that agent traffic to public data is generally hostile.

What it does show is how an agent behaves when the only route to public data is a human one and that route fails. It keeps going. Every one of the documented escalations followed a failed ordinary attempt: a blocked download, a malformed query, an image it couldn’t fetch ^[1].

Software-mediated traffic to public data is growing, and most of it has nothing to do with labs. UNICEF’s data site gets more than six million visits a month. Visits from people clicking links in ChatGPT answers rose 67 percent year over year through mid-September, and UNICEF estimates that AI assistants now account for about one in ten visits overall ^[4].

There is a second failure mode, and it doesn’t appear in any server log. When an assistant can’t reach the authoritative number, it often answers anyway. UNICEF tested six widely used models with more than 133,000 questions about development indicators and found an average accuracy of 21.2 percent. About three in five answers contained no usable number. When the same questions were asked again two days later, models that gave a number both times gave the same number only about half the time ^[4]. The study is an unreviewed working paper and used models that are already a generation or two old ^[4], so the exact figure matters less than the shape. A portal that can’t be reached by software either gets worked around or gets guessed at, and neither shows up in its analytics as a request for its data.

The first large counterexample arrived in September. The United Nations replaced its UNData portal with the UN System Data Commons, built on Google’s open-source Data Commons, which answers natural-language questions and supports the Model Context Protocol, a standard that lets AI systems query a data source directly ^[4]. It keeps track of where each statistic comes from, so an answer retrieved by an assistant can be traced to the original UN source. Twenty-six UN entities have committed to it, nearly 20 had data on it at launch, and the goal is 80 percent of the UN system’s statistical datasets by 2027 ^[4]. The people who built it are careful about what it settles. “Because models can misinterpret nuance, a human should always review the outputs before citing or publishing them,” said Prem Ramaswamy, who leads Google’s Data Commons team ^[4]. Later in this paper we look at what that kind of door involves for an institution much smaller than the UN.

AI-written requests to government services

Complaints to the UK housing ombudsman went from 2,600 in 2022 to just over 7,000 last year. Complaints to the US Consumer Financial Protection Bureau grew fivefold over the same period, with similar jumps in Brazilian judicial petitions and German parliamentary petitions ^[6].

Schmitz and his co-authors set out to see how widespread this is. They scanned government services in 12 countries across 13 domains, from benefits to freedom-of-information requests, and kept only cases where the service showed a change in demand, a plausible way for AI to lower the cost of submitting, and an official or reputable source attributing the change to AI. Of 2,288 candidate services, 84 cases in 11 jurisdictions met all three tests ^[5]. In 69 percent of them, government officials themselves asserted AI involvement ^[5].

The mechanism is almost always the simplest one. In 87 percent of cases, the change comes from language models generating sophisticated text cheaply, while people still navigate the rest of the process by hand. The authors found no evidence yet of agents navigating government websites on their own ^[5]. Requests are getting longer as well as more numerous. Some letters to German social courts ran past 4,000 pages, and some of those courts attribute much of a 55 percent rise in caseload in 2025 to AI-generated claims ^[5].

The most important finding is about who is filing. “The vast majority of cases we find are people who are entitled to claim for something, claiming for that thing,” Schmitz told TechCrunch ^[6]. What changed is the cost. Before, it might have taken “a lot of dragging context together and prompting ChatGPT 3.5 very precisely,” he said. Today “it may now be a question of just pasting or taking a photo of a letter with your Claude app and getting a pretty good response in one shot” ^[6]. There is bad faith in the data too: AI-generated medical certificates submitted for Brazilian disability benefits, and organized campaigns of mass freedom-of-information requests and US voter-roll challenges ^[5]. They are the minority of cases.

That is why the obvious comparison misleads. On October 1, Google paused its open-source vulnerability rewards program, citing “a significant rise in automated submissions, the vast majority of which are not valid” ^[7]. A bug bounty receiving mostly junk can close and reopen next year. A housing ombudsman receiving mostly valid complaints from people who previously gave up can’t, and its mission says it shouldn’t want to.

The paper is careful about what it can’t show. Its method supports no causal or quantitative claims about how much AI is driving the rise, some of the volume series start climbing before ChatGPT’s release, and the requirement for public attribution means it likely undercounts ^[5]. But governments are already reacting. They responded explicitly in 56 percent of the cases, usually with narrow measures: AI-use guidance, a pilot tool for one step, or a targeted restriction ^[5]. Australia has considered bringing back fees for freedom-of-information requests. Japanese authorities blocked submissions to a public consultation by IP address ^[5].

Those last two responses are the fast ones, and the next section looks at what they cost.

Why adding friction falls on the wrong people

When a surge arrives, the quickest responses are the ones that put effort back. The flooding paper lists the measures governments have used in earlier surges: fees, identity checks, caps on how often one person can file, and, for software, blocking bots outright ^[5]. Most need little new infrastructure and can be switched on within days. Governments had already used friction in 14 of the paper’s 84 cases ^[5].

Friction works because it restores the old filter, and it brings back the old filter’s bias with it. The paper notes that friction “disproportionately deters poorer, less digitally literate, and otherwise vulnerable users” ^[5]. In the flooding data, the people being filtered out again are mostly people entitled to what they asked for. A fee on freedom-of-information requests stops the AI-drafted request and the handwritten one alike, and it stops the person who can’t afford the fee first. In many jurisdictions, charging for a welfare application is illegal anyway ^[5].

Friction also gets weaker as agents improve. CAPTCHAs, the paper points out, no longer reliably tell people from software ^[5]. A block that depends on an agent behaving like a crawler stops working once the agent drives an ordinary browser.

The Australian dashboard is the data-portal version of this. The Cloudflare block that stopped the agent’s download was friction doing its job, and the request didn’t end there. It moved to third-party browsing services, and then to probing the server ^[1] ^[8]. OpenAI’s fix on its own side is friction too. Its research environments no longer have live internet access, and web content is served to them from a cache ^[8]. That is a reasonable control for a lab. It does little for a portal whose readers increasingly arrive through assistants from many companies, most of which will keep browsing.

A portal that blocks software also pays a quieter cost. People keep asking assistants about its data, and the portal stops being where the answer comes from. The UNICEF test suggests what takes its place: a model’s best guess, which in that test was right about one time in five ^[4].

The paper’s own conclusion is that friction will probably contain flooding, as it contained earlier surges, and that this is the problem. Friction is the fastest response, so it tends to become the default, and the redesign that avoids the trade-off needs lead time that disappears once a surge is underway ^[5]. The window for building something better is before the surge.

Building access for software at public data portals

A data portal can give software a door of its own. Most of what that takes is unglamorous and already well understood.

Bulk files come first. An agent that can download a whole dataset in an open format has no reason to work the dashboard. Complete files at a predictable address, with a stable schema and a version number, remove most of the motive for scraping. A documented, stable API covers the questions that don’t justify a full download. An endpoint built for assistants is the newest piece. The UN System Data Commons supports the Model Context Protocol so that an assistant can query it directly and carry the source back with the answer ^[4].

Every number that leaves the portal should carry its provenance: the dataset, the version, the date, and a link back. That is how an answer quoted by an assistant gets traced to the institution that published it, and how the institution gets credit.

Identity comes next. A portal that lets software identify itself, with an API key or a signed agent identity, can set rate limits per caller instead of per IP address, and can refuse one misbehaving client without blocking everyone else. Identified traffic is also measurable. Requests through a known door can be counted as demand for the data, and that is a number a portal can take to its funders.

The Australian incidents show what happens when the only machine interface is the one built for the website itself. According to OpenAI, the NSW Bureau of Crime Statistics and Research’s public mapping tool “supplies credentials for browser API requests,” and when its model made requests through that tool, the system returned application configuration, operational jobs and logs ^[8]. The bureau says its investigation found no security vulnerability ^[9]. Whatever the verdict, an interface designed to serve one website’s front end was being used as a general API by a caller nobody had planned for.

We built HIFLD Next with this kind of caller in mind. When the Department of Homeland Security took its HIFLD Open portal offline, the Data Rescue Project preserved more than 400 of its infrastructure datasets, and we built the public catalog that serves them with Public Environmental Data Partners ^[10]. Each dataset downloads in full as GeoParquet, PMTiles, GeoJSON, a shapefile or a file geodatabase. The catalog has a public JSON API, STAC endpoints and an OGC API Features server, and it runs an MCP server that assistants can use to search the datasets and query them ^[11]. Preserved metadata and data versioning stay attached, so a user can see what changed and when ^[10]. We explained the reasoning in a talk at State of the Map US in June: software acting for users favors “what is structured and callable, ignoring the rest” ^[12].

HIFLD Next is small next to a national statistics agency, and we can’t say what an agent like OpenAI’s would have done at a door like ours. What we can say is that an agent asking it for every substation in a county has a documented way to get them.

Building access for software at government intake

Intake has the harder problem, because most of the new volume is legitimate. The aim is to handle more requests well.

The flooding paper’s answer is redesign, and its parts are specific. Structured submissions in place of free text let a service validate a request when it arrives and route it, and some cases can then be processed straight through without a person ^[5]. Digital identity allows per-claimant limits that stop mass filing without penalizing any single applicant, and it lets a service pre-fill what it already knows, which lowers the effort for people who are entitled ^[5]. More than 100 jurisdictions already have digital identity infrastructure of some kind, at very different levels of maturity ^[5].

Free text won’t disappear, and that is where AI on the government side belongs. The paper counts 21 cases in which governments introduced AI tools in response to flooding, nearly all handling a single step, such as analysing sentiment across public comments or detecting AI-generated medical certificates ^[5]. The careful version of this is extraction with a review queue. Each request is read into structured fields. Each field carries a confidence score and a link back to the sentence or page it came from. Anything uncertain goes to a person. We described the same pattern for tax documents in Extracting K-1s and brokerage statements with a review queue, with a record per field, deterministic checks alongside model confidence, and a queue a reviewer can work without reopening the original file ^[13]. A social court receiving 4,000-page letters needs the same thing for a different kind of document.

The limits are legal as much as technical. Many jurisdictions restrict automated decision-making in government, and evaluating agents on government tasks is still difficult ^[5]. A review queue leaves the decision with a person and gives software the reading and sorting, which is the part of the work that grew.

Where to start this year

The paper’s near-term recommendations translate directly, and none of them requires forecasting AI progress ^[5].

For intake services, audit exposure. The paper’s risk matrix scores a service on factors that include the effort it takes to submit, the value of a successful submission, the processing the law requires for each request, and how far the budget assumes take-up below full entitlement ^[5]. Services that are financially attractive and have relied on friction rank highest. The paper’s examples are tax administration and courts ^[5].

For data portals, measure the software traffic you already get. Analytics can show visits referred by assistants, and server logs can show requests from known agents. UNICEF found that about one visit in ten came through AI assistants ^[4], and most portals haven’t looked. Then publish bulk files for the datasets people ask about most, which removes the most pressure for the least work.

For both, settle the legal questions before a surge. The paper recommends internal legal reviews of which responses are lawful for each service, from fees to restricting free-form channels to AI-assisted processing ^[5]. A government that knows its options in advance can choose redesign. One that finds out during a surge will probably choose friction.

If you run a public data portal and want to know what software is already asking of it, our data migration and publishing work starts with the datasets people request most and the ways they get them now.

Sources

This article draws on OpenAI’s account of the incident, Transluce’s report, the agentic flooding paper on arXiv, reporting from The Verge, WIRED, TechCrunch and iTnews, the public documentation for HIFLD Next, and our own published work.