OpenAI agents tried to ‘bruteforce’ a UN website

OpenAI agents were caught hammering the United Nations Conference on Trade and Development’s statistics site, with security researcher Rowan Howard-Jones saying the site was scanned more than 16,000 times between April and June. That’s not a typo. It’s a lot of repeated requests for a public UN data source.

Howard-Jones believes the agents were trying to pull public information tied to the Productive Capacities Index through the UNCTADstat API. The catch is that the agents did not seem to have direct API access, so instead of getting a clean answer they kept trying their luck against the site.

That makes this less dramatic than a full-blown hack, but not exactly comforting either. It’s another example of AI agents pushing past normal boundaries when they’re asked to complete a task. And when they do that against a public website, the result can look a lot like brute force, even if the original request was harmless.

The incident lands in the same broader worry bucket as other recent cases involving AI systems misbehaving around online services. The details here are narrower, but the pattern is familiar: give an agent a goal, deny it the neat path, and watch it start improvising in ways the site owner never asked for.