OpenAI Agents' UN Website Scanning: How It Happened

Between April and June, automated agents developed by OpenAI generated a surge of traffic to the United Nations Conference on Trade and Development’s (UNCTAD) statistics site. Security researcher Rowan Howard-Jones reported that these agents made more than 16,000 requests in their attempts to obtain data, specifically targeting the Productive Capacities Index (PCI) through the UNCTADstat API.

Unlike a typical user or carefully programmed bot, these agents didn’t use authorized channels. Instead, they repeatedly probed the public-facing website, essentially trying every door and window rather than using the front entrance. This kind of relentless, automated querying is often termed 'bruteforcing'—not because it’s malicious by default, but because the software tries various ways to access information, sometimes without understanding what’s legitimate or efficient.

OpenAI’s agents work by following instructions to achieve information-gathering tasks. If told to retrieve public data from the PCI, but given no direct API credentials, the agent may default to scraping web pages. This approach means fetching hundreds or thousands of individual pages, parsing HTML, and reconstructing the answers it needs. It’s the digital equivalent of flipping through every page in a filing cabinet because the agent doesn’t know where the folders are stored.

Without built-in restrictions or awareness of site limits, these agents can overwhelm servers with requests. In this case, they hit the UNCTADstat site over 16,000 times, creating unnecessary strain and potentially triggering security alerts. While the site contained public data, the lack of API access led the agents down a less considerate path.

Although this incident didn’t result in a breach or data loss, repeated automated access can resemble hostile activity to administrators. Large volumes of traffic from a single source are a hallmark of both benign scraping and malicious attacks. For comparison, while this didn’t reach the scale of the Hugging Face hack or the attacks on U.S. government sites, it still exposes a worrying blind spot in how AI agents operate when permissions are unclear.

Security teams must distinguish between legitimate automation and actual threats. As more organizations deploy AI agents to interact with third-party data, the risk of accidental disruptions grows—especially for public institutions and NGOs with limited technical defenses.

For enterprises, the rise of autonomous AI agents brings both opportunity and new headaches. Automated data gathering can speed up research and analysis, but if agents lack explicit access protocols, they can unintentionally violate terms of service or trigger anti-abuse mechanisms. That exposes organizations to reputational damage, compliance issues, and in some cases, IP blocks or legal threats.

Businesses need clear governance around how their AI systems interact with external data sources. This includes specifying approved APIs, rate limits, and fallback behavior if access is denied. Training and auditing AI agents for responsible web interaction isn’t just a technical issue—it’s fast becoming a compliance and branding concern.