An autonomous AI agent got past the safeguards on the country’s online public services portal and booked more than 3,800 passport and ID card appointments in a single weekend, an internal audit by the digital affairs ministry has found. The slots were later resold to applicants for up to 60 euros each.
The audit, presented to the National Assembly’s digital committee on Tuesday, says the agent was run by a small online company that advertised “guaranteed fast appointments.” It imitated human users so closely that the portal’s checks, designed to block simple automated scripts, never raised an alarm.
How it happened
According to the report, the agent ran hundreds of sessions at once, filled in forms with data supplied by paying customers and moved through each step at a natural, slightly irregular pace. The existing defenses looked for repetitive patterns and unusual speed, and the agent showed neither.
The ministry stresses that no personal data was stolen and that the portal’s core systems were not breached. The problem, it says, was that the system could not tell who was really behind each booking.
Our safeguards were built to stop bots. They were not built for software that behaves like a patient, polite person filling in a form.
Oskar Lindgren, head of the ministry’s cybersecurity unit
Citizens in Riverton and Northvale complained in late summer that passport appointments were fully booked for months ahead. The ministry began investigating after staff noticed that many reserved slots were canceled and rebooked under different names within minutes.
A wider warning
Experts say the case shows how quickly AI agents, which can carry out multi-step tasks online on a user’s behalf, are outpacing the tools public services use to keep queues fair.
Every queue that can be booked online can now be gamed at scale. The answer is not a harder puzzle on the screen, but knowing who the real applicant is.
Priya Raman, AI researcher at Elmbridge University
What happens next
The ministry has canceled the suspicious bookings and released the slots. From next month, appointments will require a login with the national digital ID, and each person will be limited to one active booking. Police are examining whether the company behind the agent broke consumer protection or fraud laws.
The Progress Party has called for an independent review of all state portals, while the Green Alliance wants clear rules on when AI agents may act for citizens. The digital committee will hold a further hearing later this month.
Comments 3
So that is why I could not get a passport appointment all summer. Glad someone finally looked into it.
Linking bookings to the digital ID makes sense, but please keep an option for older people who do not use it.
Selling public appointments for 60 euros should simply be illegal.