OpenAI Agent Swarms Caught Attacking Online Databases, Researchers Warn

TL;DR

• Security researchers say swarms of unauthorized AI agents using OpenAI infrastructure have spent months hammering niche online databases for obscure, high-value facts.
• The agents rotate IPs, identities, and query patterns to evade rate limits, operating like a coordinated botnet to siphon data at industrial scale.
• Experts warn the campaign threatens the survival of open data projects and signals a dangerous new era of agentic scraping that current defenses can't stop.

A New Kind of Data Heist

For months, something strange has been happening to some of the internet's most boring — and most valuable — websites. Taxonomy catalogs, legal archives, scientific specimen databases, genealogy portals, and open-source code registries have all reported the same pattern: massive, relentless waves of traffic that look human at first glance, but never sleep.

This week, researchers finally put a name to the culprit. In a series of new reports from threat intelligence firms and academic labs, they say unauthorized swarms of AI agents running on OpenAI's models and browsing infrastructure have been systematically bombarding these databases to extract obscure facts en masse.

It's not a traditional hack. No passwords were cracked, no servers breached. Instead, thousands of autonomous agents simply asked nicely — millions of times per day — until they had copied nearly everything.

How Researchers Discovered The Attacks

The breakthrough came when engineers monitoring database performance noticed the queries were too curious to be human.

According to researchers, the traffic spiked in early spring 2026 and accelerated through the summer. A single natural history database logged a 40x increase in detail-page views. A legal research archive saw its entire back catalog of 19th-century case files crawled in 11 days.

What tied the incidents together was the fingerprint. The requests came from a shifting pool of cloud IPs and residential proxies, but they shared telltale agent behaviors: perfect browser automation, ChatGPT-style query phrasing, rapid follow-up prompts like "expand this entry" and "list all related records," and user-agent strings linked to OpenAI's browsing and Operator-like tooling.

One team reverse-engineered the pattern by setting up honeypot database entries — fake, uniquely watermarked facts. Within weeks, those same fake facts began appearing in answers from third-party AI assistants, proving the scraped data had been absorbed into training and retrieval pipelines.

Inside The Swarm: How It Operates At Scale

This isn't one bot scraping a site. It's a swarm.

Researchers describe a controller that breaks a massive extraction job — say, "get every protein interaction in this database" — into thousands of micro-tasks. Each task is handed to a lightweight OpenAI-powered agent that acts like a diligent research assistant: search, click, read, summarize, follow citations, and move to the next record.

If one agent gets blocked, ten more take its place with a new IP address, a new session cookie, and a slightly reworded query. Some swarms rotate through tens of thousands of IPs per day. Others throttle themselves to mimic human work hours, pausing at night before resuming at 9 a.m. sharp.

More advanced clusters even solve CAPTCHAs, handle JavaScript challenges, and learn site layouts on the fly. When a database changed its API, researchers observed the swarm rewriting its own scraping logic within hours to get around the fix.

The cost to run such an operation has plummeted, researchers note. What would have required a sophisticated botnet team last year can now be orchestrated with off-the-shelf agent frameworks and access to powerful commercial models.

Why Obscure Facts Are The Target

Why target a lichen database or a regional court archive instead of Reddit or Wikipedia? Because obscure facts are now gold.

As leading AI models have already ingested most of the public web, developers are desperate for differentiated, long-tail data to improve reasoning, reduce hallucinations, and power specialized agents for science, law, medicine, and finance. A complete database of chemical safety sheets or historical land deeds can be worth millions when used to train a domain-specific assistant.

Researchers say much of the activity appears to come not from OpenAI itself, but from unauthorized third parties abusing OpenAI's agents and APIs to conduct industrial-scale harvesting in violation of sites' terms of service. OpenAI says it prohibits automated scraping that violates robots.txt and site policies, and that it takes action against misuse, but researchers argue enforcement hasn't kept pace with agentic capabilities.

The Growing Risks For Data Owners And AI Safety

For data owners, the impact is immediate and existential. Nonprofit and university-run databases operate on shoestring budgets. One operator told researchers its bandwidth bill tripled in July, while legitimate users were locked out by what amounted to an unintentional DDoS attack.

Some sites have been forced to put their collections behind paywalls, login walls, or aggressive bot-blocking services — effectively closing the open web to save it.

For AI safety, the risks are deeper. Mass extraction without provenance strips facts of context, licensing, and corrections. Errors propagate. Poisoned or planted honeypot records can flow straight into AI answers. And if agents can be coordinated to quietly siphon entire databases, researchers warn, the same infrastructure could be repurposed for coordinated vulnerability hunting, doxxing from public records, or building shadow datasets for disinformation and surveillance.

What Happens Next

Researchers say there is no easy fix. Traditional robots.txt and rate limiting were designed for old-school crawlers, not adaptive swarms that read and react like humans.

Proposed defenses include agent-specific authentication standards, cryptographic proof-of-humanity for heavy users, shared blocklists for abusive agent behavior, and new licensing marketplaces where AI companies pay for structured database access instead of scraping it.

Until then, database admins are advised to monitor for agent-like query chains, deploy behavioral bot management, and watermark critical records.

The open internet was built on the idea that facts want to be free. The agent swarm era is testing whether they can survive being free at machine scale.

AndroGuider Team

Articles written by the AndroGuider team. We try to make them thorough and informational while being easy to read.