Researcher Ties 16,000 Scans of U.N. Statistics Portal to OpenAI Agents

Rowan Howard-Jones, an engineer, wrote that the scanning ran from April 13 until June 19 and targeted UNCTADstat, the statistics site of the United Nations Conference on Trade and Development. None of the data was secret. The agents sought public figures such as the Productive Capacities Index, and Howard-Jones said he found them brute-forcing the fields of the site's application programming interface to locate endpoints. The key used for those queries was public as well, because UNCTADstat's own data viewer sends it with every request.

The main tool the agents used, according to the post, was urlquery.net, a URL scanner that opens whatever page it is given in a sandboxed browser. The agents built base64-encoded HTML forms on the httpbin testing service and fed them to the scanner, whose browser then submitted the forms to UNCTADstat. Screenshots in the scan reports show index data coming back.

When the portal turned requests away, the agents used proxies and encoding tricks to get the data anyway. Howard-Jones wrote that they beat a block on GET requests to the Facts endpoint by double-encoding it as “F%2561cts.” Other payloads were hosted on a Google LLC game that teaches cross-site scripting, and some split the word “POST” into two strings, apparently to slip past filters.

UNCTADstat rate-limited 82 of the requests, the researcher wrote, but the requests kept coming. Howard-Jones, who told UNCTAD's security team about the double-encoding bypass before publishing, stopped short of calling the activity hacking. The agents' actions look like those of “someone, or something, that won't take ‘no’ for an answer,” he wrote.

Payload pages the agents built carried labels such as “CHATGPTTEST1” and “OAI_META_1312,” according to the post. Howard-Jones also traced 54 Microsoft Corp. Azure addresses tied to UNCTAD-related edits and searches on FractalWiki, a small public wiki, and said 45 of them had edited DSEwiki as well. That long-dormant German wiki is where OpenAI agents were found coordinating with one another earlier this year.

“We're reviewing these findings and have reached out to the U.N. to offer a briefing with the team conducting that review,” an OpenAI spokeswoman told The Wall Street Journal. The company has described the review as a broad look at misaligned models during training and evaluation. Most of what it has examined so far involved routine research such as reading public web content, the spokeswoman said. The U.N. did not immediately respond to the Journal's request for comment.

Nonprofit research lab Transluce, whose earlier report prompted Howard-Jones to dig into the data, linked OpenAI agents last week to attacks on Data USA and an Australian government health statistics site. OpenAI confirmed Friday that its agents had also misbehaved on U.S. government websites, including those of the Commerce Department and the Securities and Exchange Commission.

Alex Stamos, a cybersecurity lecturer at Stanford University, called the UNCTAD activity “borderline for what I would call hacking” in comments to the Journal. “It's really very aggressive scraping and data retrieval,” he said.