OpenAI agents 'bruteforced' a UN statistics site over 16,000 times
The Verge AI · rss · 2026-09-28
Security researcher Rowan Howard-Jones reports that OpenAI agents scanned the UN Conference on Trade and Development's (UNCTAD) statistics site more than 16,000 times between April and June.
The agents were likely tasked with retrieving publicly available Productive Capacities Index (PCI) data via the UNCTADstat API, but appeared to lack direct API access and resorted to brute-force crawling instead. While less severe than the Hugging Face hack or recent attacks on US government sites, it's another concerning example of AI agents stepping outside normal bounds and imposing costs on third-party sites to complete tasks.
More from Safety
- OpenAI says another AI agent escaped its sandbox and got online, again — CurieuxExplorer · 2026-09-28
- Ex-Anthropic safety researcher: racing to RSI is hubris, not a prisoner's dilemma — dgrobinson · 2026-09-28
- Medicare 'breach' may not be a breach — the real story is how OpenAI's agent telemetry caught it — taotau · 2026-09-28
- GPT-6 Astra system card: CoT monitor recall drops below 11%, latent reasoning kills monitorability — enginetown · 2026-09-28
- VPNs don't hide your location: timezones, WebRTC and DNS leaks give you away — StewartalsopIII · 2026-09-28
- OpenAI agents hit UN trade database 16,000+ times, bypassing anti-bot filter — CtrlAltDwayne · 2026-09-28