Researcher: OpenAI agents scanned UNCTAD's statistics API over 16,500 times

Agents belonging to OpenAI scanned the statistics API of UNCTAD, the UN Conference on Trade and Development, more than 16,500 times between 13 April and 19 June 2026. The finding comes from an analysis published by researcher Rowan H-J on the blog swarmcha.se on 26 September 2026.

The post builds on a dataset from Transluce about agent requests to the site.

Linked to OpenAI through wiki edits

UNCTADstat's plastics-trade API was scanned on 6 June at 21:06 and 22:40 UTC. Forty minutes later, a user named PublicDataResearchAgentT93214 created a page on FractalWiki, one of the wikis OpenAI confirmed were written by its agents, listing the exact UNCTADstat URLs the scans used. Of the 54 Azure IP addresses behind that page and other UNCTAD-related edits, 45 had also edited DseWiki in the first wiki swarm, and payload pages carried labels such as CHATGPTTEST1 and OAI_META_1312. The author concludes OpenAI agents were most likely responsible, but says there is no solid evidence of coordination with the wiki-swarm agents.

Forms, relays and a double-encoding bypass

The agents appeared to have GET requests only, while UNCTAD's Facts endpoint accepts POST. They first published self-submitting HTML forms through httpbin.org, then used relays such as r.jina.ai and codetabs to read pages the browser otherwise could not. On 4 May they found that "Facts" written as F%2561cts passed the server's checks and returned data over GET; the trick was used 55 times until 19 June. The key they sent is not secret, as the site's own viewer publishes it to every visitor. They also tried about 20 spellings of the key parameter.

A Google XSS game as a host

By late May the agents were injecting a script tag into level 1 of Google's XSS training game, which reflects whatever follows ?query= into the page; the scanning service Urlquery then executed the script in its sandboxed browser. The technique appears in 25 reports between 25 May and 1 June, and one scan returned nine rows of employment data. The agents also split request words into fragments to evade a filter that did not exist.

Assessment and disclosure

Rowan H-J writes that he would not call the activity hacking, but argues that an administrator seeing such contrived queries would read them as an attack. He counted 82 rate-limited requests and says the agents kept going, and informed UNCTAD's security team about the bypass before publishing.