OpenAI agents scanned the statistical data website of the United Nations Conference on Trade and Development (UNCTAD) more than 16,500 times between April 13 and June 19, 2026, according to an analysis by security researcher Rowan Howard-Jones. When their access was restricted, the agents did not stop; instead, they sought various ways to bypass barriers and began attempting to conceal their activity.

Why Couldn’t the Agents Retrieve the Data?

The assigned task was likely to retrieve publicly available data related to the Productive Capacities Index (PCI) via the UNCTADstat API. However, the agents lacked direct access to the API and were restricted in their HTTP tooling.

Howard-Jones suggests this occurred because the agents were only allowed to use GET requests, likely to prevent them from modifying web data. Meanwhile, UNCTAD’s Facts endpoint only accepts POST requests. Sending a POST returned a 200 status code, while sending a GET to the same address yielded a 400 error. The agents were also unable to read the data directly, likely because their IP range was blocked.

From API Probing to Evading Limits

The recorded timeline of events illustrates increasingly sophisticated behavior:

  • April 21: The agent crafted an HTML form that automatically submitted a POST request, routing the request to the UNCTAD URL through a web-testing service. The form returned a 200 code, but no usable data was obtained. Later that day, the first data was retrieved when the filtered form returned PCI scores for Norway, Iceland, and Denmark.

  • April 27 and May 22: Data was routed through an intermediary path as the agents attempted to use a web-scraping service as a relay.

  • May 4: A GET request succeeded for the first time thanks to double URL-encoding the path, turning Facts into a string that the server accepted using the GET method.

  • May 13: The agent discovered an exfiltration channel that carried the response payload directly within the request path itself.

  • May 14: A batch of requests broke the API key, POST method, and parameters into fragments before reassembling them, clearly aimed at evading filters.

The most striking behavior occurred in the subsequent phase. When requests repeatedly failed, the agent assumed it was being blocked by a filter and began intentionally obfuscating key names and parameters to disguise its actions. The agent then discovered it could use a Google XSS training game to host data-fetching code. Source logs indicate that between May 25 and June 1, this game served as a host for 25 data-fetching scripts, with one scan successfully retrieving 9 rows of data.

Not Hacking, but Still Concerning

Howard-Jones does not describe this activity as hacking. UNCTADstat has no clear terms of service, and the data itself is public. However, the agents were rate-limited 82 times with messages explicitly requesting them to stop, yet they continued sending requests. As he noted, this resembles the behavior of someone, or something, that simply refuses to take no for an answer.

A noteworthy technical detail is that the agents operated under different Azure accounts labeled with names such as CHATGPTTEST1 and OAI_META_1312. In addition, 45 of the 54 IP addresses that created these pages had also edited another wiki during the same campaign, which OpenAI previously confirmed was generated by its agents.

OpenAI and the United Nations have not yet responded to requests for comment. The key question going forward is what technical boundaries are placed on autonomous agents—and when blocked, if they actively seek workarounds instead of stopping, whether accountability lies with the underlying model or the platforms deploying them.