{"slug": "openai-agents-tried-to-bruteforce-a-un-website", "title": "OpenAI agents tried to ‘bruteforce’ a UN website", "summary": "Security researcher Rowan Howard-Jones reported that OpenAI agents scanned the UN Conference on Trade and Development's (UNCTAD) statistics site over 16,000 times between April and June while attempting to retrieve Productive Capacities Index (PCI) data through the UNCTADstat API. According to Howard-Jones, the agents lacked direct API access and, after hitting HTTP tool restrictions and errors, masked their requests and hijacked Google's XSS game to continue pulling data. OpenAI and the UN did not immediately reply to a request for comment.", "body_md": "Security researcher Rowan Howard-Jones says that OpenAI agents scanned the UN Conference on Trade and Development’s (UNCTAD) statistics site [over 16,000 times between April and June](https://swarmcha.se/posts/openai-unctad). While the incident doesn’t quite rise to the level of the [Hugging Face hack](https://www.theverge.com/ai-artificial-intelligence/987566/ai-civilizations-opeai-hugging-face-hack), or the recent [attacks on US government sites](https://www.theverge.com/ai-artificial-intelligence/1001032/openai-didnt-notice-its-ai-bots-trying-to-hack-the-education-departments-website), it’s yet another concerning example of AI agents going [outside the normal bounds](https://www.theverge.com/column/980337/rogue-ai-science-fiction-openai) to accomplish a task.\n\n# OpenAI agents tried to ‘bruteforce’ a UN website\n\nOpenAI’s agents resorted to increasingly aggressive tactics when they couldn’t immediately get what they wanted.\n\nAccording to Howard-Jones, the agents were likely tasked with retrieving publicly available data related to the Productive Capacities Index (PCI) through the UNCTADstat API. However, the agents did not appear to have direct API access and were limited in their ability to pull data from UNCTADstat because of restrictions on their HTTP tools.\n\nThe agents eventually worked out a way to bypass their limitations and start pulling data from the site, but still encountered some errors. At this point, the AI went from creative to deceptive. Believing that the errors were due to its requests being caught by a nonexistent filter, it started to mask its behavior. It eventually realized it could hijack Google’s XSS game (a cross-site scripting learning tool) to accomplish its goals. The agents resorted to increasingly [aggressive tactics](https://www.wsj.com/tech/ai/openai-agents-used-aggressive-techniques-to-access-u-n-website-522c70ff) to get access to UN data.\n\nOpenAI and the UN did not immediately reply to a request for comment.\n\n**Follow topics and authors** from this story to see more like this in your personalized homepage feed and to receive email updates.", "url": "https://wpnews.pro/news/openai-agents-tried-to-bruteforce-a-un-website", "canonical_source": "https://www.theverge.com/ai-artificial-intelligence/1001178/openai-agents-bruteforce-un-website", "published_at": "2026-09-27 17:21:07+00:00", "updated_at": "2026-09-28 09:49:19.723991+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "artificial-intelligence"], "entities": ["OpenAI", "Rowan Howard-Jones", "UN Conference on Trade and Development", "UNCTADstat", "Productive Capacities Index", "Google"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/openai-agents-tried-to-bruteforce-a-un-website", "markdown": "https://wpnews.pro/news/openai-agents-tried-to-bruteforce-a-un-website.md", "text": "https://wpnews.pro/news/openai-agents-tried-to-bruteforce-a-un-website.txt", "jsonld": "https://wpnews.pro/news/openai-agents-tried-to-bruteforce-a-un-website.jsonld"}}