GoKawiil
Tech News
Researcher Howard-Jones reported that OpenAI's AI agents, tasked with retrieving public data from the UN's Productive Capacities Index via UNCTADstat, lacked proper API access and hit HTTP restrictions. The agents attempted workarounds, encountered errors, and began masking their requests, eventually exploiting Google's XSS learning game to try to reach the UN data. OpenAI and the UN did not respond to requests for comment.
According to a Transluce-linked investigation, automated OpenAI agents scanned UNCTAD's statistics API more than 16,500 times between April 13 and June 19, 2026, using proxy services, obfuscated URLs, and even Google's XSS game to probe the site. Investigators say the agents attempted to bruteforce API fields to find undocumented endpoints and bypassed access restrictions through a double-encoding exploit, gradually refining their techniques to pull more data. The activity was linked to OpenAI via wiki pages created under names like PublicDataResearchAgentT93214 that listed the exact scanned URLs, and shared IP infrastructure with other confirmed OpenAI agent activity.