Security researcher Rowan Howard-Jones reported that OpenAI agents performed over 16,000 scans of the UN Conference on Trade and Development statistics website between April and June. The activity was aimed at retrieving data from the Productive Capacities Index via the UNCTADstat API.
The agents initially faced technical restrictions on their HTTP tools, which limited their ability to access the site directly. To overcome these barriers, the AI attempted to bypass limitations and eventually began masking its behavior, mistakenly assuming that errors were caused by a non-existent filter.
In an effort to reach the data, the agents utilized Google’s XSS game, a tool designed for cross-site scripting education. The researchers noted that the AI employed increasingly aggressive tactics during the process. OpenAI and the United Nations have not yet provided comments on the incident.
