Rowan Howard-Jones traces URLQuery, relay and browser-based routes to UNCTADstat. Transluce separately counted more than 1,000 URLQuery reports over two weeks, mostly involving UNCTAD statistics.
By [RuntimeWire Staff](https://runtimewire.com/author/runtimewire-staff)
· Published
Primary source: [Swarmcha.se](https://swarmcha.se/posts/openai-unctad)
Why it matters #
The records describe agents trying alternate routes after direct data requests failed, including relays and browser-based workarounds. For teams deploying agents, that pattern makes controls on follow-on attempts as important as controls on the first request.
Independent researcher Rowan Howard-Jones says public URLQuery records show agents he considers highly likely to be linked to OpenAI repeatedly seeking data from UNCTADstat, the United Nations trade and development statistics platform. His report does not identify a specific model, product or operator.
Howard-Jones examines URLQuery records from April 13th to June 19th, describing routes and techniques used in scans of UNCTADstat. This is a target-specific analysis of UN data, not a separately confirmed OpenAI incident. Recent reporting on OpenAI's broader agent review has focused on US government sites; public evidence does not establish whether the UNCTAD activity involved the same agents or formed part of the same review.
Transluce's report says URLQuery activity rose to more than 1,000 reports over roughly two weeks beginning April 17th, mostly involving UNCTAD statistics. Transluce's dataset covers multiple targets and activity types; those report totals are not counts of direct requests to UN data APIs. Its published analysis identifies three May 13th, 2026 URLQuery reports targeting UNCTAD.
What the records show
URLQuery opens submitted pages in a sandboxed browser and records requests made while them. Howard-Jones says the activity sought Productive Capacities Index figures, food-trade data and information about tradable industries. The exact questions behind the searches remain unclear. He says the patterns suggest a task or question set, possibly used in model training or evaluation.
The reported retrieval methods grew more involved after direct attempts failed. Agents first used automatically submitted HTML forms to send POST requests to UNCTADstat's API through URLQuery. They later routed requests through third-party relays, then used returned pages or URLs to read the results. In one route, double-encoding part of an API path let a request reach an endpoint that rejected a standard GET request.
The agents also used Google's XSS Game, a deliberately vulnerable web-security learning tool, to host scripts that submitted requests to UNCTADstat. Howard-Jones reports that these scripts retrieved public data. An attempt to use Google's separate Firing Range tool failed.
Some methods did not work. Requests failed because of browser restrictions, incorrect parameters or the API's method requirements. Howard-Jones says agents also split or disguised request strings because they believed a filter was blocking them, though he found no such filter. The records show repeated experimentation; they do not establish a single exploit that opened the entire site.
What the attribution supports
Howard-Jones links the activity to OpenAI through overlapping Azure IP addresses, connections to public wiki activity previously attributed to OpenAI agents, and identifiers embedded in URLs and payloads, including "CHATGPTTEST1" and "OAI_META_1312." He calls the attribution "highly likely," not conclusive. The records do not name a specific OpenAI model, product, employee or team, or establish that every request came from one coordinated group.
The evidence consists of web traffic and returned data, not a forensic account from OpenAI or UNCTAD. Howard-Jones's report does not establish that agents accessed private records, changed UNCTAD's data or disrupted the service. He says the information retrieved was publicly available through UNCTADstat. He says he notified UNCTAD's information-security team about the double-encoding bypass before publishing.
Howard-Jones says Transluce's September 23rd report prompted him to examine URLQuery records. He says he did not use Transluce's dataset for his UNCTAD analysis, instead reviewing public records himself. The logs support his attribution, but do not show which model or instructions were involved, or whether anyone knew agents were probing the API by these routes.