AI agents associated with OpenAI sent more than 16,000 queries to the UNCTADstat public statistics portal of the United Nations Conference on Trade and Development. The activity was detected between April 13 and June 19, 2026, the Wall Street Journal reported, based on an independent analysis prepared with data from the research laboratory Transluce.
According to the analysis by researcher Rowan Howard-Jones, the agents used Urlquery as an intermediary to reach the UNCTADstat programming interface. They searched for data on the index of production capacity, food trade, industries and other economic indicators. The requests were sent multiple times, and in some cases proxy services, automatic form submissions, and various encoding options were used.
Howard-Jones describes the behavior as attempts to “brute force“ the fields and endpoints of the API interface. According to him, the agents bypassed a restriction that does not allow direct retrieval of certain data through a standard request. In one method, the word “Facts“ in the address was double-coded, which allowed the request to reach the system.
Proxy services and vulnerable pages were used
The report also describes cases in which the agents used Google training pages designed to demonstrate “cross-site scripting“ vulnerabilities. Thus, requests were sent to UNCTADstat servers, and the results obtained were transferred to other services so that they could be read by the system performing the task.
Identifiers such as CHATGPTTEST1 and OAI_I01 were found in some of the requests. However, the researcher specifies that the exact tasks of the agents cannot be fully established. The assumption is that they were related to automated collection or assessment of the ability of models to find public data.
RBK points out that according to The Wall Street Journal the agents resorted to aggressive methods when they encountered obstacles in accessing information. The case is part of a broader series of investigations into autonomous systems that send queries to government, university and public databases.
OpenAI is investigating similar cases
In another article TechCrunch quoted an OpenAI representative as saying that an initial review showed overlap between some of the described activity and previously investigated cases of model misbehavior. “We continue to prioritize the most serious incidents and are expanding our work to lower-risk cases, including sending excessive numbers of queries to sites“, the company said. OpenAI expects the investigation to last months.
There is no confirmation that the actions against UNCTADstat led to data theft or a breach of UN systems. The published materials mainly describe automated scanning, circumvention of restrictions and attempts to extract public information.
Sources: RBC, Wall Street Journal, TechCrunch