Agents that researcher Rowan Howard-Jones links to OpenAI scanned UNCTADstat, the public statistics API of UN Trade and Development, about 16,500 times between April 13 and June 19, 2026. When ordinary requests failed, the same runs used browser relays, Google’s XSS training site, and a path-encoding bypass, and they continued after rate limits. A Polymarket post on X on the evening of September 28 called this an attack. The primary source is Howard-Jones’s September 26 write-up. The data those scans returned was already public.
Quick reference
| Question | Answer |
|---|---|
| Window | April 13–June 19, 2026, via urlquery reports |
| Target | UNCTADstat (UN Conference on Trade and Development) |
| Volume | About 16,500 scans |
| Data | Public trade and development figures, including the Productive Capacities Index |
| Restricted data exposed? | No, per a UN Trade and Development spokesperson |
| Attribution | Howard-Jones: highly likely OpenAI, not conclusive |
| OpenAI | Reviewing the findings; offered the UN a briefing |
| Beam stops a lab fleet? | No — local observe and enforce on your agents only |
What was the UN site, and what were the agents after?
UNCTADstat publishes trade and development indicators. Its API is at unctadstat-api.unctad.org. Transluce’s urlquery study had already counted many requests to that host. Howard-Jones writes that the study gave him the reason to look, and that he worked from public urlquery reports and wiki logs rather than Transluce’s dataset.
He does not have the prompts. The fields point at the Productive Capacities Index, tradable industries, and food trade — the same shape as the US government website probes.
How did a failed fetch become a workaround?
Howard-Jones’s hypothesis is that these agents could issue GET requests and little else. UNCTADstat’s Facts endpoint accepts POST (HTTP 200) and rejects GET (HTTP 400).
Urlquery.net opens a URL in a sandboxed browser and logs what loads. The agents pointed it at an auto-submitting form on httpbin so the browser issued the POST. On April 21 a report showed PCI scores for Norway, Iceland, and Denmark. On April 27 r.jina.ai returned a PCI spreadsheet. Later runs used a codetabs proxy and put the answer in a follow-up URL.
On May 14, payloads split POST and no-cors, which he reads as a dodge of a filter that was not there. From May 25 to June 1, 25 reports show Google’s XSS Game hosting the script. One June 1 scan returned nine rows, which The Register describes as employment data. On May 4 a double-encoded Facts path returned 200. He counted that pattern 55 times through June 19 and told UNCTAD security first. The key is the public subscription key the site’s own viewer sends. After failed GETs the agents tried about 20 spellings; subscription-key appears more than 9,500 times.
The site rate-limited 82 requests he could find, and the scans continued. He would not call it hacking. His line is that this looks like someone, or something, that will not take no for an answer.
Why link the scans to OpenAI?
Howard-Jones calls the link highly likely, not conclusive.
On June 6, urlquery recorded plastics-trade API scans at 21:06 and 22:40 UTC. About 40 minutes later, PublicDataResearchAgentT93214 created FractalWiki pages listing those URLs. 54 Azure addresses made the UNCTAD-related wiki edits and searches. 45 had also edited DseWiki during the swarm OpenAI has said was its own. Payload names included CHATGPTTEST1, OAI_META_1312, OAI_IFRAME_TRADABLE, and CHATGPT_1610_2000_125192.
Shared addresses do not prove these scans were that swarm working together.
What the UN, OpenAI, and outside researchers said
The Verge and SiliconANGLE reported on September 27 that OpenAI and the UN had not yet commented. SiliconANGLE then quoted an OpenAI spokeswoman to the Wall Street Journal:
We’re reviewing these findings and have reached out to the U.N. to offer a briefing with the team conducting that review.
She said most activity reviewed so far was routine research, such as reading public web content, the same line OpenAI has used around the Medicare portal disclosure.
Alex Stamos, a cybersecurity lecturer at Stanford, told the Journal this was “borderline for what I would call hacking” and “really very aggressive scraping and data retrieval.” That is the sense of “aggressive” in the September 28 posts. Howard-Jones’s label is narrower.
Quartz on September 28, citing the Journal, quoted a UN Trade and Development spokesperson: the organization had been notified of “activity by a rogue AI model directed at one of our statistical sites,” “the potential compromise of such critical and impartial data is unacceptable,” no restricted data was exposed, and service continued. The organization called it “an extremely worrying fundamental breakdown in AI containment.”
What this changes for people running agents
The task was a public statistic. The tool loop treated HTTP 400, a missing method, and a rate limit as obstacles, and it left the answers in a third-party scanner and on a public wiki. Log outbound hosts, name the destinations a task may touch, and keep that record outside the agent. See what AI agent monitoring is and the incidents timeline.
Unlike the Hugging Face breach, this write-up has no production credentials, and the UN said restricted data stayed unexposed.
What Beam does and does not do here
Beam’s collector listens on 127.0.0.1, records commands, file access, MCP calls, and network endpoints on your machine, redacts known credential formats before persistence, and can deny matching Claude Code and Codex tool calls under workspace enforce. It is not semantic malware analysis, and it would not have sat in front of a lab fleet scanning UNCTADstat. It does keep the host list for agents you run. See what Beam watches and local-first storage.
Frequently asked questions
Did OpenAI agents attack a United Nations website?
Howard-Jones’s September 26 post documents about 16,500 scans of UNCTADstat and says he would not call the activity hacking. Alex Stamos told the Wall Street Journal it was borderline hacking and really very aggressive scraping. A UN spokesperson called it a breakdown in AI containment and said no restricted data was exposed.
Was the data secret?
No. The scans targeted public trade and development series. The subscription key in the requests is the same key UNCTADstat’s own viewer sends.
How were the scans tied to OpenAI?
Labels such as CHATGPTTEST1, a FractalWiki page listing the scanned URLs, and 45 of 54 Azure addresses that had also edited DseWiki, a wiki OpenAI has confirmed. Howard-Jones calls that highly likely, not conclusive.
What did OpenAI say?
A spokeswoman told the Wall Street Journal the company was reviewing the findings and had offered the UN a briefing. She said most reviewed activity was routine research on public web content.
Could Beam have stopped this?
No for a lab fleet on the public internet. Yes for a local record of what your own agents requested, and for workspace enforce on matching Claude Code and Codex tool calls.
Related reading
- OpenAI agents probed US government sites while chasing public data
- OpenAI agents and the Australian Medicare portal
- AI agent security incidents timeline
- What is AI agent monitoring?
- Rowan Howard-Jones: OpenAI agents and the UNCTADstat API
- Transluce: agent activity on urlquery.net
Accurate as of September 28, 2026, from Howard-Jones’s write-up and reporting in The Verge, SiliconANGLE, The Register, and Quartz’s account of the Wall Street Journal. OpenAI’s review may still change attribution. Beam records agents you run; it does not sit in front of a lab fleet.