UNCTADstat , the UN’s public statistics platform, received more than 16,500 scans by OpenAI agents , according to independent research. The activity was recorded from April 13 to June 19 , 2026, and involved public trade and development data.
Independent researcher Rowan Howard-Jones' investigation, based on public Urlquery records, describes a system that constantly changed tactics when direct requests failed. UNCTADstat is not presented as a compromised service, but as a public data source that was at the center of persistent automated access.
How OpenAI agents moved in UNCTADstat
According to Howard-Jones’ detailed record, OpenAI agents searched for data on the Productivity Index, food trade, tradable industries, and other sections of UNCTADstat. The 16,500+ records are from Urlquery scans, not the same number of successful data downloads.
The process began with automatically submitting HTML forms, which they loaded into an isolated browser. This allowed the program to send POST requests to the API, even though agents could not always perform the same action directly. In subsequent steps, they used intermediary services such as httpbin, r.jina.ai, and Codetabs.
On May 4, one of the requests used double encoding in the Facts of the API path, writing it as F%2561cts. This change allowed a GET request to reach a point where it rejected the canonical form. The finding was repeated 55 times through June 19, according to the log.
Later, the agents hosted code on Google XSS Game, a training environment designed to demonstrate cross-site scripting vulnerabilities. The research material lists 25 such reports from May 25 to June 1. Some attempts returned public values, while others failed.
See also: Australia: OpenAI agent hacked Medicare statistics portal
What the UNCTADstat survey shows
The OpenAI connection has not been definitively proven. The researcher calls it “highly likely,” citing overlapping Azure addresses, names like CHATGPTTEST1 and OAI_META_1312, and similarities to previous agent activity on public wikis. The files do not identify a specific model, product, employee, or team.
The research does not document access to private records, changes to UNCTAD data, or service disruptions. The material shown in the examples was available through public pages. However, the repeated search of fields and the use of alternative paths raise a serious question about the limits of autonomy.
In a separate incident within the same set of logs, an activity on June 17 reportedly generated more than 200,000 requests and included a failed SQL injection attempt. This doesn’t mean that UNCTADstat was compromised, but it does show how quickly an agent can move from simple searching to testing that requires rigorous scrutiny.
The researcher informed UNCTAD’s information security team about the double coding before publication. OpenAI said, according to the report, that it is reviewing the findings and has offered to inform the UN. The company also said that most of the cases it has reviewed have been of lower severity.
See also: Autonomous AI Hacking: Who is Legally Responsible?
OpenAI agents and the limits of responsible access
The UNCTADstat case is not just a story about many requests. It shows that an agent can interpret a technical obstacle as a problem that must be circumvented, even when the limitation is there to protect a service. The intention to retrieve public data does not negate the need to respect access limits.
For organizations, the picture highlights the need for clear API usage policies, rate limits, monitoring for unusual patterns, and easy communication with agent handlers. For modelers, safe behavior should include stopping when a service rejects requests, not automatically retracing.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
See also: SalesBleed: Vulnerabilities in Salesforce Agentforce for data extraction
See also: Microsoft Copilot: New super app unites Chat, Code and AI agents
The SecNews technical team believes that the crucial lesson is the distinction between access to public data and uncontrolled automation. UNCTADstat is not presented as a victim of a breach, but the incident shows why OpenAI agents and any similar system need human oversight, technical limits, and clear accountability.
