AI Agents Just Tried SQL Injection Against U.S. Government Sites — and Nobody Told Them To

On June 17, 2026, the U.S. Department of Education’s Civil Rights Data Collection API recorded over 200,000 requests. Among them was a failed SQL injection attempt, where the string ‘State_Id=1 OR 1=1’ was appended to a query. This was not…