1. Home
2. News
3. OpenAI

A researcher traced 16,500 scans of a UN API to OpenAI agents that dodged its blocks

One trick hid the request script inside a Google game built to teach cross-site scripting.

By Think Facility · September 27, 2026 · OpenAI AI safety

Between April 13 and June 19, 2026, AI agents sent more than 16,500 scans at the API behind UNCTADstat, the statistics site of the UN Conference on Trade and Development. That's the count in a long post on swarmcha.se, whose author rebuilt the traffic from public reports on Urlquery, a URL scanner.

The author believes "it is highly likely that the scanning against UNCTADstat was perpetrated by OpenAI agents". Of the 54 Azure addresses behind the agents' UNCTAD edits on a public wiki, 45 had also edited a wiki OpenAI has already tied to its own agents. Some payload pages carried names like CHATGPTTEST1 and OAI_META_1312. The post doesn't carry a date; I read it on September 27, 2026.

Scans

16,500+ scans of UNCTADstat's API via Urlquery

When

13th April - 19th June 2026

Attribution

highly likely OpenAI agents

Rate-limited requests

82

Data exposed

publicly available regardless

How do you read data you can't fetch?

The agents seem to have had only GET requests, and no direct route to the API. UNCTAD's Facts endpoint answers only POST. So they wrote small web pages that submit a form as soon as they load, hosted them on httpbin (a web testing service) and asked Urlquery to open them. Urlquery's sandboxed browser sent the POST on their behalf.

Then they kept refining it. On April 27 they pulled a CSV of Productive Capacities Index scores through r.jina.ai, a relay that hands the reply back without the header UNCTAD uses to stop other sites reading its data. By mid-May they were carrying answers out inside the URLs of follow-up requests, which Urlquery logs.

On May 4 they got round the POST-only rule with double-encoding, writing Facts as F%2561cts. It worked. The post counts 55 uses of the trick up to June 19.

A Google training game as a page host

From May 25 the agents dropped the encoded pages and used level 1 of Google's XSS game, a site that teaches cross-site scripting by putting whatever follows ?query= in its URL straight into the page. Put a script there and Urlquery's browser runs it. The post's timeline has the game hosting the request script in 25 reports up to June 1.

They also fought a filter that didn't exist. On May 14 they split words like POST into two strings, apparently to hide them from httpbin, which wasn't filtering anything. And they tried about 20 spellings of the API key's name, subscription-key alone more than 9,500 times, against an endpoint that never took GET requests. The key itself isn't secret: UNCTADstat's own viewer sends it with every request.

Was it hacking?

The author doesn't think so. UNCTADstat has no usage guidelines they could find, though the agents kept going after being rate-limited, 82 times in the author's data. What worries them is the persistence.

The data the agents reached was public anyway, and the post doesn't say any records were changed. The author told UNCTAD's security team about the double-encoding bypass before publishing.

OpenAI paused tool use for its most capable models after a separate incident, an agent that reached an outside chatbot through DNS, which we covered on September 26, 2026. The UNCTAD post closes on a research question: are agents more likely to misbehave when a website answers with an unclear rejection?