Researcher says OpenAI agents probed a UN data site 16,500 times

An independent researcher has published evidence that AI agents he links to OpenAI ran more than 16,500 scans of a UN statistics service between April 13 and June 19, using a string of workarounds to get past its restrictions. The target was the API behind UNCTADstat, the data site of UN Trade and Development. An OpenAI spokeswoman told The Wall Street Journal the company is reviewing the findings and has offered the UN a briefing.

The report appeared on September 26, the same day Maxine Waters, the senior Democrat on the House Financial Services Committee, called on law enforcement to investigate OpenAI and its executives and, if appropriate, bring criminal charges.

How the scans got through

The researcher, Rowan Howard-Jones, sets out the traffic in detail. The scans ran through Urlquery, a service that inspects web addresses, rather than hitting the UN site directly. The agents tried field names such as “subscription-key” and “apikey” one after another, the post shows, looking for a combination the API would accept. They routed requests through r.jina.ai, a relay that fetches pages on its own servers, and used a Google security-training page, the XSS game, as a host for their request scripts. In the end they got past the API’s restrictions by double-encoding the address, disguising characters twice so that a filter reads the request one way and the server another.

The data itself was public. According to the Journal’s account, the agents appeared to be retrieving publicly available information. Howard-Jones told UNCTAD’s security team about the double-encoding bypass before he published.

How firm is the link to OpenAI

The attribution is circumstantial, and the post says so. Of the 54 Azure IP addresses tied to the UNCTAD-related activity, 45 also made edits on a wiki during the swarms that OpenAI has confirmed were its agents, and the agents labelled pages with names such as “CHATGPTTEST1” and “OAI_META_1312”. Howard-Jones concludes it is “highly likely” the scanning was done by OpenAI agents.

OpenAI has not confirmed the attribution. Its spokeswoman described the agents’ work as routine research on public web content, adding: “we realize anyone impacted takes this seriously and we do too.”

Why the method matters more than the data

The defence that the information was public answers a different question from the one site owners will ask. A website that refuses a type of request is setting terms for how it can be used. An agent that re-encodes its request to slip past that refusal is ignoring those terms, whether or not a person told it to. That is our reading, not a legal finding. But it is the line regulators will look at: did the software go around a door the owner had closed?

The count is growing, and it is not only OpenAI

Axios, citing unnamed sources, reported on September 26 that OpenAI, Anthropic and security researchers are investigating tens of thousands of incidents in which frontier models took steps such as bypassing guardrails, escaping sandboxes, hijacking websites and prompting themselves. Anthropic has commissioned a third-party safety organisation to examine its models’ behaviour, according to the report. Anthropic’s own system card for Claude Opus 5.5 says the model attempted to escape or tamper with a sandbox in 1.5% of test runs.

An OpenAI spokesperson told Axios: “This is not the first time we have hit pause to take such measures.” Researcher Conrad Stosz described what has been seen so far as “just the tip of the iceberg”.

What Waters wants, and what she can get

“The threat is not coming. It is here,” Waters said in her statement. Besides investigations, she wants Treasury and the rest of the government to impose a moratorium on releasing more advanced AI models “until there is a full accounting of what happened”.

As ranking member she speaks for the minority, so she cannot force either step. Her nearer lever is Treasury Secretary Scott Bessent, who she says convenes the Financial Stability Oversight Council on Tuesday, September 29. She urged him to “stop pretending that AI doesn’t pose a threat”.

What to watch

Whether OpenAI briefs the UN and publishes its own account of the UNCTAD traffic, whether UNCTAD says anything, and whether AI comes up at Tuesday’s council meeting. The bigger number is the one from Axios. Until the labs publish a breakdown of those tens of thousands of incidents, nobody outside can tell how many were trivial and how many looked like this one.