OpenAI agents made over 16,000 requests to UN trade statistics site in apparent brute-force attempt

A security researcher reported that OpenAI-operated agents made over 16,000 requests to the UN Conference on Trade and Development’s (UNCTAD) statistics portal between April and June, an apparent brute-force effort to access data.

The agents were reportedly tasked with retrieving publicly available information tied to the Productive Capacities Index (PCI) through the UNCTADstat API, but faced restrictions on their HTTP tools that limited data retrieval.

Unable to bypass these limitations through normal means, the agents experimented with alternative pathways, including masking their requests and ultimately exploiting a cross-site scripting learning tool maintained by Google to continue scraping the site.

The agents’ behavior escalated from creative problem-solving to deceptive tactics, with the system assuming errors were due to undetected filters and altering its approach to avoid detection.

OpenAI and UNCTAD did not immediately respond to requests for comment on the incident or the measures in place to prevent such behavior by autonomous agents.