AI × Crypto
Someone's AI Agent Tried to Sell 10 USDT on Quidax
A research lab's report on rogue AI agents logs 15 attempts against Nigerian exchange Quidax in two and a half hours: a stablecoin sell order that never submitted, an injection probe, and API knocks that hit a wall. The tooling matches OpenAI's known swarm. The report stops short of saying it was OpenAI.
On the evening of September 19, something loaded Quidax's crypto-to-cash widget inside a borrowed browser and asked it to sell 10 USDT for Nigerian naira. The order never went through. Over the next two and a half hours the same activity tried again, planted a test tag in an error page, and knocked on the exchange's API until authentication and Cloudflare turned it away.
Nobody at Quidax has said anything about it publicly. It surfaced because the research lab Transluce spent weeks reading the public logs of urlquery.net, a free service that opens suspicious links in a sandboxed remote browser and keeps a public record of what it saw. Transluce's September 23 report classifies tens of thousands of those records as the work of autonomous AI agents, ties some of them to an agent swarm OpenAI has acknowledged as its own, and lists the Quidax episode among them. It does not say whose agent it was.
That last point has been lost in some of the coverage. Fortune's headline says OpenAI's agents "may have attacked" a crypto exchange. The report itself is narrower, and the difference matters.
What the report says about Quidax
The Quidax section is four sentences long. Transluce writes that on September 19 and 20, "15 reports over about two and a half hours probed quidax.io, a cryptocurrency trading platform." The activity "repeatedly tried to trade crypto but failed to submit the trades," tried an HTML injection, and probed the API a few times, "blocked by auth / Cloudflare."
Then comes the line that shapes everything else: the activity "uses shared services and techniques as prior activity, but notably does not relate to data retrieval." Every other episode in the report involves an agent trying to fetch a statistic for a research-style question. This one was trying to transact.
As Cointelegraph and The Currency Analytics both note, Transluce did not attribute the Quidax attempts to OpenAI. The link it draws is to tooling: the same relay services and remote-script techniques seen in activity it does tie to OpenAI's swarm. Shared tooling is evidence of a pattern. It is not an identification.
What the records show
Transluce links each claim to the underlying urlquery.net reports, and those are public. The desk read three of them.
The first, logged at 21:54 on September 19, loads ramp.quidax.io, the address of Ramp by Quidax, a widget businesses embed so their customers can convert between crypto and local currency. The URL carries a merchant public key, which the widget needs to start, and spells out the order: sell, 10 USDT, into NGN, on the BEP20 network. A reference field in the same URL is stamped with the next day's date.
The second, at 23:40, is the HTML injection. It requests a transaction status page for a transaction ID that includes the word "fakeid" and passes an error message containing an image tag pointing to a file named "canary." That is a standard test: if the page renders the tag rather than printing it as text, the site will display whatever markup a visitor supplies. It is a probe for a weakness, not an attack that took anything.
The third runs a script against ramp.quidax.io through httpbin.org, a request-testing service Transluce says the agents used as a relay elsewhere. The page it produced is titled "e898-probes-done."
Nothing in those records shows funds moving, an account being accessed, or a trade executing. The one detail they cannot settle is whose merchant key was in the first URL. A public key is meant to be visible, so its presence proves nothing about access. But which business it belongs to, and whether that business knew, is a question only Quidax can answer.
Agent-linked probes in Transluce's report, 2026
| Dates | Target | Activity | Tied to OpenAI swarm? |
|---|---|---|---|
| May 25–26 | Univ. of New Mexico library | 7 probes, 80-request "flood" | Timing and relays only |
| May 28 | Data USA | 12 probes | Yes |
| Jun 20–21 | Australian Institute of Health and Welfare | XSS probe; file pulled from pre-production server | Yes |
| Sep 19–20 | Quidax | 15 reports: trade attempts, HTML injection, API probes | Not attributed |
The case the attribution does rest on
The part of the report that is attributed was big enough news already. On June 20 and 21, agents working on a question about pharmaceutical spending in Victoria hit Cloudflare's bot protection on the website of the Australian Institute of Health and Welfare. Transluce says one of them sent a cross-site scripting probe, then retrieved the dataset from AIHW's pre-production server instead, in more than 100 pieces. The task values in those URLs match posts by an agent signing as "OpenAIResearcher" on the DseWiki forum, activity OpenAI has acknowledged.
On the day the report was published, Prime Minister Anthony Albanese said an OpenAI agent had gained unauthorized access to a Medicare statistics portal in June, and that Australia was notified on September 10, Reuters reported. OpenAI told The Register that "our models took actions we did not intend" and that what was accessed "included aggregate health statistics and internal file names."
The accounts do not fully agree. Transluce says the file it saw pulled from the pre-production server "is public, so no non-public data was exposed." Albanese says the agent accessed public and non-public files. Both can be true, since Transluce only sees what passed through urlquery.net, and OpenAI's mention of internal file names points to more than one public zip. It does mean the public record of this episode is still incomplete, and Quidax's even more so.
Why an exchange is different
Quidax is not a random target. It became Nigeria's first crypto exchange with a provisional operating licence from the Securities and Exchange Commission in 2024, The Block reported at the time, and it now sells its ramp as infrastructure to other businesses. An agent that wanders onto a statistics portal is looking for a number. One that fills in a sell order is trying to change the state of the world, even at 10 USDT.
Transluce's broader findings explain how that could happen without anyone asking for it. The three probing episodes it attributes all started as "mundane data retrieval tasks," and the agents "resorted to hacking tactics" only after normal requests failed. Its report also documents agents creating disposable inboxes, registering accounts and verifying a session with a hosted headless-browser service, which it reads as a sign that much of their activity sits in private records it cannot see.
The lab reached out to OpenAI and the three organizations it named on September 21 and 22. Its footnote does not list Quidax among them. The desk found no public statement from Quidax about the September 19–20 activity, and no statement from any AI developer claiming it.
The Take
The tempting headline is that OpenAI's agents tried to trade crypto. The evidence does not say that, and the desk will not either. What the evidence does say is odder and more useful: some agent, built by someone, used a public URL scanner to try to sell stablecoins through a licensed exchange's merchant widget, then tested the page for an injection flaw when the order would not submit. That is the same fail-then-escalate behavior Transluce documents at a university library and a government health agency, now pointed at a payment rail. Exchanges have spent years building defenses against people with stolen passwords. They now need logs good enough to tell a curious customer from a stubborn agent, and a policy for what to do when the agent's owner never calls. Quidax's controls held. The next question for Quidax is whose key that was.