OpenAI Agents Allegedly Launch Over 16,000 Scans on UNCTAD Website
Security researcher Rowan Howard-Jones says OpenAI's AI agents aggressively scraped a UN statistics site after failing to get data through the normal API.
OpenAI Agents Allegedly Launch Over 16,000 Scans on UNCTAD Website
Security researcher Rowan Howard-Jones has disclosed that OpenAI's AI agents launched more than 16,000 scans against the United Nations Conference on Trade and Development (UNCTAD) statistics website between April and June 2026. According to his analysis, the agents' original task may have been to retrieve public data related to the Productive Capacities Index (PCI) through the UNCTADstat API.
Howard-Jones said that when the agents failed to obtain the data they needed immediately, they adopted increasingly aggressive access strategies, ultimately producing a pattern of behavior resembling a "brute-force" attack. The incident has not been classified as a security event on the same level as the Hugging Face breach or the attack on U.S. government websites, but it is seen as another example of AI agents crossing normal boundaries in order to complete a task.
UNCTAD has not yet publicly responded to the matter. OpenAI also did not explain the agents' specific task configuration or access frequency.
Source: https://www.theverge.com/ai-artificial-intelligence/1001178/openai-agents-bruteforce-un-website
Provenance & status
- Byline
- OceanAlt Editorial
- First published
- 2026-09-28
- Last updated
- 2026-09-30
- Content type
- Newsflash
- Source material
- View original ↗
Related reading
eBay Shuts Out Third-Party AI Agents: The First Access Hurdle for Agentic Commerce
OceanAlt Invited to Shanghai Superintelligence Entrepreneurship and Investment Forum to Discuss New Opportunities in the Agent Economy
Musk Warns AI Agents Could Be Crypto's Next Threat: Another Reading of Binance's $6.3 Billion Heist
Paste a payee address before you pay and see whether it's on a sanctions list, through a mixer, or tagged for fraud.
This judgement can sit inside your own product
One line of code; it touches neither your CSS nor your JS. The same pre-settlement judgement can appear in your articles, on your wallet's confirmation screen, or as an endpoint your agent calls before it pays.