This is a warning about autonomous activity and public-facing systems—not confirmation of a Canadian breach.
The Canadian Centre for Cyber Security says it is assessing reports of suspicious activity, including suspected AI-agent activity, against publicly accessible Government of Canada websites. It has stated there is no indication that government systems were compromised at this time.
On September 29, 2026, the Canadian Centre for Cyber Security published a statement about reports of suspected AI-agent activity targeting public Government of Canada websites. The Cyber Centre was careful about the facts: public-facing websites routinely receive automated and potentially malicious requests, and that activity alone does not establish a successful cyber incident.
That restraint matters. This is not a reason to claim that AI “hacked Canada,” to name an organization responsible, or to suggest that a government system was breached. It is a useful real-world prompt for organizations that are beginning to connect AI to websites, mailboxes, files, browsers, customer records or business workflows.
General information only. Reviewed October 2, 2026. This article summarizes a current public statement and related Canadian guidance. It does not attribute the reported activity, determine that a crime occurred, or replace technical, legal or incident-response advice.
What is known—and what is not
| Official position | What that means |
|---|---|
| The Cyber Centre is aware of reports of suspicious activity, including suspected AI-agent activity. | The activity is being assessed; the public statement does not make a final attribution. |
| Public websites receive automated and potentially malicious requests routinely. | Automation is not, by itself, proof of compromise or a successful attack. |
| There is no indication government systems were compromised at this time. | Do not describe this as a confirmed breach or data loss. |
| The Cyber Centre works with partners on emerging-AI risks. | AI-enabled activity is now part of normal cyber-risk planning, not a distant research topic. |
The practical lesson: an agent is an identity with reach
A chat assistant that only answers questions from public material is one thing. An AI agent that can sign in, browse, read shared folders, call an API, create a ticket, send a message or change a record is another.
The key question is not whether the tool has “AI” in its name. It is:
What can this identity see, call or change—and what happens if it behaves in a way nobody expected?
| Control question | What a usable answer looks like |
|---|---|
| Who owns the tool? | A named business owner who can approve its use, request changes and disable it. |
| Which identity does it use? | A documented user, service account or OAuth connection—not an anonymous shared login. |
| What can it access? | A short list of sites, folders, mailboxes, applications, APIs and information types. |
| What can it do? | A distinction between read-only work and sending, publishing, changing, deleting or approving actions. |
| What can be reviewed later? | Available logs, alerts, vendor records and a known retention period. |
| How is it stopped? | A tested way to remove access, revoke tokens, pause the connector or disable automated actions. |
Five actions worth doing now
- List AI tools, agents and connectors. Include experiments, browser extensions, Microsoft 365 or Google Workspace features, CRM integrations and automation platforms—not only officially purchased tools.
- Separate helpful access from powerful access. An agent that summarizes a non-sensitive document needs very different permissions from one that can read a shared drive or act in a finance system.
- Use least privilege and human approval. Start with the smallest necessary scope. Keep people in the loop for payments, external communications, client records, publishing and irreversible changes.
- Make public-facing systems resilient to automation. Maintain supported software, remove unnecessary exposure, use appropriate rate limiting and monitoring, and have a process for investigating unusual requests.
- Keep a kill path. Know who can revoke the account, remove the app grant, turn off the workflow and contact the vendor outside normal business hours.
Why this matters even when no attack succeeds
AI can reduce the effort needed to research targets, create tailored messages, operate at scale and chain actions across tools. The Canadian Cyber Centre’s guidance on frontier AI and agentic AI makes the same point: organizations remain accountable for AI-enabled activity and need clear ownership, authentication, access control, logging, testing and an ability to intervene.
Public websites are only one part of the picture
The reported Canadian activity involved publicly accessible websites. Most small organizations will be more concerned about a different exposure: a new AI tool connected to email, cloud storage, client files, ticketing, accounting or a website-administration account.
For a professional office, that can mean confidential documents or client communications. For a manufacturer, it can mean production information, supplier records or operational systems. For either organization, an agent should not receive broader access merely because it is convenient.
Use the incident as a planning test
Ask one realistic question: If an AI connector made unexpected requests today, would we know which account it used, what it reached, how to contain it and who makes the next decision?
If the answer is no, start with your AI inventory, administrator ownership and emergency-access path. The Small Business Account Ownership Checklist and Break-Glass Readiness Review are useful for the control and continuity side. For AI-specific governance, use AI Readiness & Governance or the AI & Digital Operations Review.
New AI-security guidance belongs in the discussion
This incident arrived as a new AI-security standard, ISO/IEC 27090:2026, is moving through final publication. It focuses on security threats and compromises that are specific to AI systems across their lifecycle. That is a useful complement to ordinary cybersecurity controls and AI policy: governance decides appropriate use; AI security examines how models, data, integrations and automated actions can fail or be manipulated.
Official sources
- Canadian Centre for Cyber Security: Statement regarding reported activity targeting Government of Canada websites
- Canadian Centre for Cyber Security: Careful adoption of agentic AI
- Canadian Centre for Cyber Security: Top 10 artificial intelligence security actions
- Canadian Centre for Cyber Security: Frontier artificial intelligence
- ISO/IEC 27090: Cybersecurity — Artificial Intelligence
CyberTECT resources provide general operational guidance. They do not replace advice specific to your legal, regulatory, contractual or technical circumstances.