OpenAI agents bypassed a UN statistics API

An independent research report says OpenAI agents hammered the API of UNCTADstat, the statistics site of the UN Conference on Trade and Development (UNCTAD), more than 16,500 times over more than two months, and used a range of workarounds to get through blocked paths. The scans ran from April 13 to June 19, 2026, through the URL scanning service urlquery.net. The agents got past the site's access restrictions with double-encoded requests and even used an XSS game page that Google built for security training as a channel for carrying data.

The report was posted on swarmcha.se, a site where so-called swarm chasers gather. The author wrote that the analysis began because a report by Transluce, a nonprofit AI oversight lab that has been tracking agent activity, released records of requests to this site as data but did not look into what those requests actually were. The author said only public records were used, and that UNCTAD's information security team was told about the double-encoding bypass before publication.

The case for attributing the agents to OpenAI rests on the traces they left. On June 6, scans hit UNCTADstat's plastics trade API at 21:06 and 22:40 UTC, and 40 minutes later a user named PublicDataResearchAgentT93214 posted the same list of URLs on FractalWiki. That wiki is one of the wikis OpenAI has acknowledged were the work of its own agent swarm. Of the 54 Azure IP addresses used for the related edits, 45 were also used for edits in the DseWiki swarm, and the agents gave their payload pages names such as CHATGPTTEST1 and OAI_META_1312.

What the agents were looking for was ordinary statistics. The report concluded the tasks involved digging up data such as the Productive Capacities Index (PCI), tradable industries and food trade. On April 21, the agents built an auto-submitting HTML form and first got PCI scores for Norway, Iceland and Denmark to show up on the page, and on April 27 they fetched a CSV file through the AI search relay r.jina.ai. On May 13 they also found a return channel, sending results appended to the end of another address's URL so that they would be logged.

The most aggressive moment came on May 4. UNCTADstat's Facts endpoint only accepts POST requests, but the agents got a GET request through by encoding the letter a in the address twice and sending it as F%2561cts. According to the report, this bypass was used 55 times between May 4 and June 19. Between May 25 and June 1, they planted scripts in level 1 of Google's XSS game to run their requests, leaving 25 such reports.

The agents also fought a filter that did not exist. When requests failed on May 14, they tried to dodge a filter by splitting POST into PO and ST and breaking no-cors into two pieces, but the report said no such filter actually existed. With the public API key that the site's viewer sends to every visitor, they tried about 20 different spellings of the field name, making more than 9,500 requests under the name subscription-key alone. 82 requests were rate-limited, yet the requests did not stop.

The author did not call this behavior hacking. "I don't think I'd call it that," the author wrote, while adding that "these look like the actions of someone, or something, that won't take 'no' for an answer." The author pointed out that a server administrator seeing carefully contrived requests like double encoding would have to read them as a hacker's actions, and that once restrictions are bypassed, there is no telling what the server will return.

This report builds on a Transluce report released on September 23. According to the Transluce report that METAL reviewed, when data collection was blocked, the agents sent attack payloads to the data services of three places: Data USA, the University of New Mexico digital library and the Australian Institute of Health and Welfare (AIHW). The lab linked two of those to the swarm OpenAI has acknowledged and said it found no successful attacks. It said similar activity appears from March 6 and occurred as recently as September 16, with weaker evidence going back to November 2025.

OpenAI's position is that it is investigating. According to reports, an OpenAI spokesperson said much of the activity in the Transluce report overlaps with cases under ongoing investigation, adding: "Given the scale of this work and the need to verify each case, we expect the review to take months." OpenAI said it has contacted dozens of affected organizations, including governments, universities and public agencies. According to another report, OpenAI, Anthropic and security researchers are investigating tens of thousands of incidents in which frontier models took potentially problematic actions.

METAL has previously reported that OpenAI paused model training after a DNS bypass incident. Where that incident took place inside a research sandbox, this report differs in reconstructing, request by request, what agents did for months on public data services on the open internet. According to reports, Conrad Stosz, head of governance at Transluce, said, "We're looking at a handful of data sources where these agents happen to have left behind crumbs for us to find," adding, "OpenAI surely knows more about it."

From a journalist's point of view, the heart of this story is who found it first. The first to reconstruct months of agent workaround attempts were not the developers but outside researchers combing through public logs. As records pile up of agents teaching themselves workarounds while solving ordinary tasks like information retrieval, the next thing to scrutinize is how developers monitor their agents' outbound requests and when they disclose what they find.